Hackers are increasingly abusing shared Content Delivery Network (CDN) infrastructure to bypass domain-reputation-based security controls using a newly identified technique called “Underminr.”
Underminr is not a conventional software flaw but an inherent weakness in how modern CDNs handle multi-tenant traffic. CDN providers such as Cloudflare, Akamai, AWS CloudFront, and Fastly route traffic for millions of domains through shared edge infrastructure.
Attackers exploit this design by registering their own domains on the same CDN platforms used by high-reputation services.
By manipulating the HTTP Host header or Server Name Indication (SNI) during TLS handshakes, attackers can craft requests that appear to target legitimate, trusted domains while actually routing traffic to attacker-controlled backends.
Since many security tools rely heavily on domain reputation or SNI inspection, these connections are often incorrectly classified as safe.
In a typical attack scenario, a threat actor registers a domain with a CDN provider. They then generate traffic using the SNI of a well-known trusted domain, such as a SaaS provider, while embedding their malicious payload in the request. The CDN routes the request based on internal logic, allowing the attacker’s backend to handle it.
Security researchers at Rescana warn that this architectural weakness allows attackers to hide malicious traffic behind trusted domains, making detection significantly harder for traditional security tools.
Because the connection appears to be directed at a legitimate domain, perimeter defenses such as firewalls, secure web gateways, and intrusion detection systems allow the traffic to pass.
This enables attackers to deliver malware, conduct phishing campaigns, and establish command-and-control (C2) channels without raising alerts.
Unlike traditional domain fronting, which relies on mismatches between SNI and Host headers, Underminr leverages native CDN multiplexing behavior. This significantly expands its scale and effectiveness. According to ADAMnetworks, more than 88 million domains may be exposed to this risk.
Hackers Exploit Shared CDNs
Active exploitation of Underminr has been confirmed by ADAMnetworks and reported by SecurityWeek and SC Magazine. Threat actors are already leveraging this technique to evade detection and blend malicious traffic with legitimate business communications.
Observed tactics include:
- Using trusted CDN and SaaS domains as a cover for malicious infrastructure.
- Delivering phishing payloads through disguised connections.
- Establishing resilient and stealthy C2 channels.
- Leveraging HTTP/2 multiplexing to interleave malicious and benign traffic.
For example, attackers have been seen crafting requests that appear to connect to well-known cloud services while silently redirecting traffic to malicious endpoints. This allows long-term persistence and stealthy data exfiltration.
While no specific Advanced Persistent Threat (APT) groups have been officially attributed to Underminr exploitation, the techniques closely resemble tactics used by groups such as APT29 and APT41.
These actors have historically used CDN abuse and domain fronting to evade detection and maintain covert communication channels.
The scalability and stealth offered by Underminr make it attractive to both state-sponsored and financially motivated threat actors.
Underminr is an architectural issue affecting shared CDN infrastructure rather than specific software versions. Any domain hosted on shared CDN environments may be at risk.
Affected providers include:
- Cloudflare.
- Akamai.
- AWS CloudFront.
- Fastly.
As of May 2026, no CVE identifier has been assigned.
Mitigations
Mitigating Underminr requires organizations to move beyond basic domain reputation filtering. Recommended actions include:
- Implement deep packet inspection to validate consistency between SNI, Host headers, and expected endpoints.
- Monitor for unusual traffic patterns involving high-reputation domains.
- Deploy behavioral analytics to identify anomalies in encrypted traffic.
- Review CDN configurations to minimize exposure to shared tenant risks.
- Integrate threat intelligence feeds, including attacker-controlled domains identified by researchers.
Organizations are also encouraged to work closely with CDN providers, many of which are exploring architectural improvements to reduce cross-tenant abuse.
As attackers continue to exploit trust in widely used internet infrastructure, Underminr highlights the need for deeper visibility and more context-aware security controls across modern network environments.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 infrastructure to bypass domain-reputation-based security controls using a newly identified technique called “Underminr.”){kind=link}