article thumbnail

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

Krebs on Security

” The DNS part of that moniker refers to the global “ D omain N ame S ystem ,” which serves as a kind of phone book for the Internet by translating human-friendly Web site names (example.com) into numeric Internet address that are easier for computers to manage. PASSIVE DNS.

DNS 262
article thumbnail

Sunburst: connecting the dots in the DNS requests

SecureList

In the initial phases, the Sunburst malware talks to the C&C server by sending encoded DNS requests. These requests contain information about the infected computer; if the attackers deem it interesting enough, the DNS response includes a CNAME record pointing to a second level C&C server. Low-level details. avsvmcloud[.]com”

DNS 74
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

GALLIUM Threat Group targets global telcos, Microsoft warns

Security Affairs

The Microsoft Threat Intelligence Center (MSTIC) warns of GALLIUM threat group targeting global telecommunication providers worldwide. The Microsoft Threat Intelligence Center (MSTIC) warns of GALLIUM threat group targeting global telecommunication providers worldwide. ” reads the warning published by Microsoft.

article thumbnail

INTERNET BLOCKING IN MYANMAR – SECRET BLOCK LIST AND NO MEANS TO APPEAL

Security Affairs

In March 2020, The Ministry of Telecommunications (MoTC) issued a directive to all operators in Myanmar with a secret list of 230 sites to be blocked due to the nature of the content; adult content and fake news. Our findings show that both Telenor and MPT block websites using DNS tampering. Original post at: [link].

article thumbnail

Quad9 to move offices to Switzerland, invites other privacy-focused firms to follow

SC Magazine

.” Quad9 is a non-profit offering a free recursive DNS service that does not log user data. It offers additional privacy and security features, including screening for malicious domains and encryption. and Google Public DNS. Other alternatives in the same space include Cloudflare’s 1.1.1.1 are wary of U.S.

DNS 96
article thumbnail

WinDealer dealing on the side

SecureList

It primarily goes after targets located in China, such as foreign diplomatic organizations established in the country, members of the academic community, or companies from the defense, logistics and telecommunications sectors. Layout of the encrypted data. x33x44”). Description. Sample value (in hex). Unknown static value.

Malware 115
article thumbnail

Alleged Iran-linked APT groups behind global DNS Hijacking campaign

Security Affairs

Security expert uncovered a DNS hijacking campaign targeting organizations in various industries worldwide and suspects Iranian APT groups. It is interesting to note that FireEye confirmed that this campaign is different from other operations carried out by Iranian APT groups due to the use of DNS hijacking at scale.

DNS 76