Shadow DNS Operation Abuses Compromised Routers to Manipulate Internet Traffic

A sophisticated shadow DNS network that hijacks internet traffic by compromising home and business routers.

The operation, active since mid-2022, manipulates DNS resolution through malicious resolvers hosted by Aeza International (AS210644), a bulletproof hosting provider sanctioned by the U.S. Treasury Department in July 2025.

The threat campaign targets older router models, modifying their DNS configuration to redirect all network traffic through attacker-controlled resolvers rather than legitimate ISP servers.

When compromised routers are discovered, every device behind them unknowingly relies on a shadow DNS infrastructure that selectively alters DNS responses.

This allows threat actors to redirect users to malicious websites, deliver unwanted advertisements, or potentially conduct adversary-in-the-middle attacks on critical services.

The shadow network operates through a two-stage traffic distribution system (TDS). First, compromised DNS resolvers return altered IP addresses for specific domain queries.

Second, an HTTP-based TDS fingerprints connecting devices and routes them to affiliate marketing platforms or malicious content. This dual-layer architecture has enabled the operation to remain undetected for years.

Technical Infrastructure

Researchers identified over three dozen recursive DNS resolvers operating within the Aeza network.

Each compromised router receives a pair of shadow resolvers that return DNS answers with extremely short 20-second time-to-live values, forcing devices to repeatedly query the malicious infrastructure and making detection difficult through traditional analysis.

The threat actors employ selective manipulation based on multiple factors including requested domain names, router location, query timing, and randomization.

Popular domains like Google and Facebook typically receive legitimate responses to avoid detection, while domains for services like Shopify and Okta may be redirected to attacker-controlled infrastructure.

The resolvers even answer queries for non-existent domains that normally would fail to resolve.

A clever evasion technique prevents security testing of the shadow DNS servers. The infrastructure only responds to DNS queries without Extension Mechanisms for DNS (EDNS0), an extension introduced over a decade ago and included in standard DNS implementations.

When EDNS0 is enabled as it is in most modern DNS software queries return malformed responses that appear as errors.

Only by specifically disabling EDNS0 using commands like dig +noedns @89.208.105.113 shopify.com can researchers trigger legitimate responses from the shadow resolvers.

When browsers connect to altered IP addresses returned by the shadow DNS, JavaScript fingerprinting scripts determine whether devices are truly behind compromised routers.

The scripts include DNS queries for domains that should not resolve, such as gettranslate[.]ir. If these unregistered domains fail to resolve, the script redirects users to Google, avoiding suspicion.

Successful resolution confirms the device is using shadow DNS, triggering redirection through affiliate marketing smartlinks to advertising platforms or malicious content.

When a user’s browser connects to the altered IP address, e.g., 147.45.69.3, the device is fingerprinted and then directed to the next stage of the TDS if it passes the initial checks.

Analysis of the JavaScript code revealed seemingly abandoned infrastructure, including URLs for domains never registered by the threat actors.

Current versions attempt connections to gettranslate[.]ir on port 18443 before forwarding traffic to adtech platforms tracked through domains like effectivegatecpm[.]com, where traffic is resold and users eventually see various advertisements or scams.

Real-World Impact

Affected users have reported frustrating experiences across online forums. One Reddit user titled their help request “HELP im going insane” after experiencing constant redirections.

Others complained about inability to access Google Sheets or regular redirections when using Chrome browsers.

These reports suggest the threat extends beyond simple router compromise, potentially affecting systems where DNS-over-HTTPS should protect against router-level DNS manipulation.

One victim using OpenMTCPRouter described their virtual router being compromised after misconfigured network rules exposed it publicly.

The attack installed cryptocurrency miners, locked out the admin account, and redirected DNS to the shadow infrastructure. This indicates threat actors may deploy additional payloads beyond affiliate marketing.

Controlling DNS resolution grants threat actors extraordinary power beyond delivering advertisements.

Shadow DNS can selectively intercept queries for critical services lacking SSL certificates, deny access to antivirus updates for persistence, or manipulate software update mechanisms for lateral movement within networks.

DNS underpins virtually every aspect of internet communication, establishing trust and connecting resources across all services.

The campaign recalls the 2011 DNSChanger malware operation run by an Estonian company that changed DNS configurations to serve advertising while blocking antivirus updates. More recently, Chinese threat actors have manipulated DNS resolver settings to target software updates for network infiltration.

The Aeza shadow DNS represents an evolution of these techniques with improved stealth and persistence mechanisms.

The shadow network also pollutes DNS research databases. Commercial passive DNS services that collect “port 53” traffic absorb false records from shadow resolvers alongside legitimate authoritative name server responses.

Researchers unaware of this contamination may draw incorrect conclusions from compromised data sources.

Organizations and home users should verify their router DNS settings match their ISP’s legitimate resolvers or trusted public DNS services.

Router firmware should be updated to latest versions, and default administrative credentials must be changed. Network administrators should monitor for unusual DNS query patterns and implement DNS-over-HTTPS where possible to encrypt DNS traffic.

Security teams should test DNS resolution against known-good resolvers to detect potential compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.