DNS Infrastructure Hijacking Campaign

[Firefox]

Last updated 2/13/2019

DNS Infrastructure Hijacking Campaign

Summary

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised credentials, an attacker can modify the location to which an organization’s domain name resources resolve. This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization’s domain names, enabling man-in-the-middle attacks.

See the following links for downloadable copies of open-source indicators of compromise (IOCs) from the sources listed in the References section below:

https://www.us-cert.gov/ncas/alerts/AA19-024A

[Amaroq_Starwind]

Maybe the business line of MalwareBytes products should start incorporating IOCs.

[exile360]

They already do for their products that include their Forensic Timeliner application (refer to the info on this page and this page as well as this article).