Thursday, April 18, 2024

Hackers Hijacked More Than 100,000 Routers DNS Settings and Redirecting Users to Malicious WebSites

Hackers hijacked 100,000+ Routers and modified their DNS settings to redirect their DNS requests through malicious DNS servers to steal banking credentials.

The DNSChanger campaign named GhostDNS appears to be starting from September 20, 2018, and it grows significantly by adding a bunch of new scanners. The campaign attempts a brute force on the router’s web page or bypass authentication using dnscfg.cgi exploit.

The malicious campaign primarily focuses on Brazil, according to Netlab’s report more than 100k+ routers infected (87.8% located in Brazil), and 70+ router/firmware have been involved, and 50+ domain names such as some big banks in Brazil and even Netflix.

GhostDNS Hijacked 100,000+ Routers

The GhostDNS is made up of four different parts DNSChanger Module, Phishing Web module, Web Admin module, Rogue DNS module.


DNSChanger Module

The module is responsible for information collection and carries out attack by using three DNSChanger sub-modules against the routers on both internet and intranet networks. This DNS changer module consists of 100+ attack scripts that affecting 70+ different routers.


While examing one of the sub-module PyPhp DNSChanger which contains 69 attack scripts against 47 different routers/firmware, Netlab discovered some statistics information which shows this particular module itself infected more than 62,00 routers.


Web Admin

Researchers found the admin panel in one of the PyPhp DNSChanger node contains the login page of the Web Admin System.

Rogue DNS module

The Rouge DNS server contains a number of hijacked domains, primarily banking domains, cloud hosting services, and domain belongs to security company Avira.

Phishing Web module

The rogue DNS server hijacks targeted domain’s and resolves them to phishing server and the phishing server servers corresponding phishing site.

With this ghosts campaign between 09-21 to 09-27, the hackers primarily targeted users located in Brazil.


Netlab says GhostDNS system poses a real threat to the Internet. It is highly scaled, utilizes diverse attack vector, adopts automated attack process.

Related read

Hackers Hijacked 7,500+ MikroTik Routers and Redirecting User Traffic to Attackers

Hackers Hijacking DLink Routers to Gain Bank Credentials By Using Various Router Exploits

Hackers Attack Over 200,000 MikroTik Routers & Infected with Mass Coinhive Cryptojacking Malware


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles