Tag: dns hijacking

10 Attack Reports | 0 Vulnerabilities

Attack reports

Not Just Annoying Ads: Adware Bundles Delivering Gh0st RAT

A sophisticated malware campaign is distributing both Gh0st Remote Access Trojan and CloverPlus adware simultaneously through obfuscated loaders. The loader drops encrypted payloads from its resource section, with one being adware and another a Gh0st RAT DLL module executed via rundll32.exe. The RA…

remote access trojan

dead drop resolver

registry persistence

Published: April 17, 2026

Linked vulnerabilities : CVE-2023-27350

Downloadable IOCs: 2

APT28 exploit routers to enable DNS hijacking operations

Russian cyber actors APT28 have been exploiting routers to overwrite Dynamic Host Configuration Protocol (DHCP)/Domain Name System (DNS) settings to redirect traffic through attacker-controlled DNS servers. Resulting malicious DNS resolutions enable adversary-in-the-middle (AitM) attacks that harve…

Published: April 7, 2026

Linked vulnerabilities : CVE-2023-50224 (CVSS 6.5)

Downloadable IOCs: 58

Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various…

poisonplug.shadow

traffic manipulation

gateway-monitoring

Published: February 5, 2026

Downloadable IOCs: 80

Compromised Routers, DNS, and a TDS Hidden in Aeza Networks

A shadow DNS network and HTTP-based traffic distribution system (TDS) hosted in Aeza International, a sanctioned bulletproof hosting company, has been discovered. The system compromises routers, altering their DNS settings to use shadow resolvers. These resolvers selectively modify responses, direc…

affiliate marketing

traffic distribution system

compromised routers

Published: February 4, 2026

Downloadable IOCs: 10

Network devices compromised for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

adversary-in-the-middle

software update hijacking

network implant

daemoniclogistics

Published: November 19, 2025

Downloadable IOCs: 4

PlushDaemon compromises network devices for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

adversary-in-the-middle

software update hijacking

network implant

daemoniclogistics

Published: November 19, 2025

Downloadable IOCs: 7

Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor

Hazy Hawk, a sophisticated threat actor, exploits abandoned cloud resources of high-profile organizations through DNS hijacking. By identifying and taking over dangling CNAME records pointing to unused cloud services, they create malicious URLs on reputable domains. These URLs lead users to scams a…

traffic distribution systems

cloud resources

affiliate marketing

push notifications

Published: May 21, 2025

Downloadable IOCs: 19

The Good, the Bad and the Ugly in Cybersecurity – Week 20

This intelligence update covers recent cybersecurity events. In positive developments, global authorities disrupted a major botnet, arrested a ransomware actor, and dismantled a dark web marketplace. On the negative side, a malicious NPM package was discovered hiding multi-stage malware using Unico…

omserverservice.exe

omclientservice.exe

output messenger

kurdish military

Published: May 16, 2025

Linked vulnerabilities : CVE-2025-27920 (CVSS 9.8)

Downloadable IOCs: 1

Marbled Dust leverages zero-day in Output Messenger for regional espionage

A Türkiye-affiliated espionage threat actor, Marbled Dust, has been exploiting a zero-day vulnerability in Output Messenger since April 2024. The attacks target Kurdish military entities in Iraq, allowing the actor to deliver malicious files and exfiltrate data. The exploit involves a directory tra…

data exfiltration

omserverservice.exe

omserverservice.vbs

omclientservice.exe

output messenger

directory traversal

Published: May 13, 2025

Linked vulnerabilities : CVE-2025-27920 (CVSS 9.8), CVE-2025-27921 (CVSS 6.1)

Downloadable IOCs: 3

Automatically Detecting DNS Hijacking in Passive DNS

This article describes a machine learning-based pipeline for detecting DNS hijacking using passive DNS data. The system processes an average of 167 million new DNS records daily, extracting 74 features from over 169 terabytes of data. Between March and September 2024, it identified 6,729 hijacking …

machine learning

network security

threat detection

domain compromise

Published: November 5, 2024

Downloadable IOCs: 37

Click here to see more Attack Reports