Hackers are exploiting shared CDN edge infrastructure to bypass DNS-based security controls, according to new research from ADAMnetworks, which details a stealthy evasion technique dubbed “Underminr.”
The core issue lies in how content delivery networks (CDNs) route traffic across shared edge IP addresses. In this attack, a device performs a legitimate DNS lookup for a trusted domain, such as whatismyipaddress.com, which resolves to a CDN edge IP.
However, instead of communicating with that domain, the attacker initiates a TLS connection to the same IP using a different hostname, such as evilsite.ai, via Server Name Indication (SNI) or HTTP Host headers. Because both domains are hosted on the same CDN edge, the connection succeeds, creating a blind spot for security tools that rely solely on DNS logs.
CDN Edge Abuse Enables DNS Evasion
This mismatch between DNS resolution and application-layer routing introduces a critical detection gap. While the endpoint appears to connect to a trusted service, the actual communication is redirected to a malicious destination.
In practice, an endpoint may resolve a benign domain to an IP address, such as 104.19.223.79, but then establish a TLS session using a different SNI value tied to an attacker-controlled domain. The CDN accepts and routes the request internally, enabling command-and-control (C2) traffic, data exfiltration, or policy evasion without raising alerts.
Although the technique resembles legacy domain fronting, it operates differently. Domain fronting, largely mitigated by major providers around 2018, relied on mismatched SNI and HTTP Host headers to disguise traffic.
Underminr, by contrast, exploits inconsistencies between DNS resolution and CDN routing behavior. The DNS query appears legitimate, and the connection is established to the resolved IP address. However, the SNI and HTTP Host headers reference a completely different domain hosted on the same infrastructure.
This evolution allows attackers to bypass modern defenses that were specifically designed to detect or block traditional domain fronting. By leveraging shared edge environments, adversaries can blend malicious traffic with legitimate CDN activity, making detection significantly more difficult.
Multiple Attack Modes Observed
- Simple Mode: Uses a trusted DNS query followed by a deceptive SNI to access a malicious domain.
- Split Mode: Establishes a legitimate TLS session to pass inspection, then reconnects with a malicious SNI.
- ECH Mode: Uses Encrypted Client Hello to conceal the true destination hostname from inspection systems.
- Direct-to-IP Mode: Connects directly to CDN IPs without generating DNS telemetry, bypassing DNS-based controls entirely.
The Underminr technique significantly enhances adversarial capabilities by enabling stealthy and persistent access within protected environments. Attackers can establish reliable C2 channels, exfiltrate sensitive data, and bypass network egress controls using encrypted tunnels that appear legitimate.
The reduced need for complex infrastructure also lowers the barrier to entry, making it easier for both advanced threat actors and less sophisticated groups to launch effective campaigns.
Researchers note similarities between this approach and tactics used by China-aligned threat groups such as Flax Typhoon, Webworm, and GALLIUM.
These actors frequently use tools such as SoftEtherVPN to create encrypted tunnels that blend into normal traffic. The behavior aligns with MITRE ATT&CK techniques, including T1133 (External Remote Services) and T1572 (Protocol Tunneling), highlighting its role in long-term persistence and covert operations.
The findings expose a fundamental limitation in DNS-based security models. Protective DNS can block known malicious domains, but it cannot verify whether traffic routed through a trusted domain ultimately reaches a different destination. When shared infrastructure is involved, this trust model breaks down, allowing attackers to operate undetected.
To reduce risk, organizations must adopt layered detection strategies that correlate DNS activity with network and application-layer signals. Monitoring discrepancies between DNS queries and TLS session parameters, restricting direct IP connections, and deploying advanced traffic analysis tools are critical steps.
ADAMnetworks is also introducing a shared threat intelligence initiative and an online assessment tool to help organizations identify exposure to this emerging attack vector.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
