Saturday, November 2, 2024
HomeComputer SecurityHackers Launching DNS Hijacking Attack to Gain Access to Telecommunication & ISP...

Hackers Launching DNS Hijacking Attack to Gain Access to Telecommunication & ISP Networks

Published on

Malware protection

Researchers discovered a new malicious campaign called “Sea Turtle,” attack public and private entities in various countries using DNS hijacking as a mechanism.

State sponsored threat actors compromise at least 40 different organizations across 13 different countries during this malicious campaign in the first quarter of 2019.

Attackers carried out highly persistent tactics and advanced tools to gain access to sensitive networks and systems.

- Advertisement - SIEM as a Service

DNS hijacking is a type of malicious attack that used to redirect the users to the malicious website by modify DNS name records when they visit the website via compromised routers or attackers modifying a server’s settings.

Threat actors targeting two different groups of vicims, primary victims are national security organizations, ministries of foreign affairs, and prominent energy organizations and the second group of victims are numerous DNS registrars, telecommunication companies, and internet service providers.

Initially they targeting the 3rd party that provide services to the primary targets to perform DNS hijacking.

Researchers alerts that the current DNS hijacking campaign is more severe and sophisticated than the previous attacks.

How Does This DNS Hijacking Attack Performed

In the first way, threat actors manipulating and falsifying DNS records by obtaining the organization’s network administrator credentials to modify the DNS records.

A second way to access DNS records via DNS registrar who sells domain names to the public and manages DNS records and the domain registry are accessed through the registry application using the Extensible Provisioning Protocol (EPP).

In this case, attackers obtain one of these EPP keys to modify any of the DNS records that managed by the Registrar.

Actors behind Sea Turtle ultimately intended to steal credentials to gain access to networks and systems by performing the following way,

  1. Established a means to control the DNS records of the target.
  2. Modified DNS records to point legitimate users of the target to actor-controlled servers.
  3. Captured legitimate user credentials when users interacted with these actor-controlled servers.
DNS Hijacking Attack

Threat actors behind the Sea Turtle campaign either exploiting the known vulnerability or sprear-phising emails to compromise the victims in the initial stage.

Once the successfully gain the network access, attacker would modify the NS records for the targeted organization and the pointing users to a malicious DNS server.

This access gives lets attacker to redirect the users who queried for that particular domain around the world to the macious domain.

According to Talos Research, Once the actor-controlled name server was queried for the targeted domain, it would respond with a falsified “A” record that would provide the IP address of the actor-controlled MitM node instead of the IP address of the legitimate service. In some instances, the threat actors modified the time-to-live (TTL) value to one second.

Later attacker build a MitM servers that impersonated legitimate services to capture user credentials and gives a lot more sensitive access to the targeted organization.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Miner Malware Uses Multiple Propagation Methods to Infect Windows Machines and to Drop Monero Miner

Two Hackers of Bayrob Malware Gang Convicted for Infecting more than 400,000 Computers Worldwide

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...