Global DNS Infrastructure Hijacking Campaign

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), is aware of a global Domain Name System (DNS) infrastructure hijacking campaign.

Using compromised credentials, an attacker can modify the location to which an organisation’s domain name resources resolve. This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organisation’s domain names, enabling man-in-the-middle attacks.

Protect Youself

• Implement multifactor authentication on domain registrar accounts, or on other systems used to modify DNS records.
• Verify that DNS infrastructure (second-level domains, sub-domains, and related resource records) points to the correct Internet Protocol addresses or hostnames.
• Search for encryption certificates related to domains and revoke any fraudulently requested certificates.