article thumbnail

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

Krebs on Security

” The DNS part of that moniker refers to the global “ D omain N ame S ystem ,” which serves as a kind of phone book for the Internet by translating human-friendly Web site names (example.com) into numeric Internet address that are easier for computers to manage. PASSIVE DNS.

DNS 262
article thumbnail

Turkish Sea Turtle APT targets Dutch IT and Telecom firms

Security Affairs

Between 2017 and 2019, the APT group mainly used DNS hijacking in its campaigns. The group targets government entities, Kurdish (political) groups like PKK, telecommunication, ISPs, IT-service providers (including security companies), NGO, and Media & Entertainment sectors; Over the years, the group enhanced its evasion capabilities.

Media 111
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

RuNet – Russia successfully concluded tests on its Internet infrastructure

Security Affairs

The authorities want to ensure that the access to Russian Internet resources will be maintained also under attack, to do this, Russian experts are thinking a sort of DNS managed by Moscow. Currently, among the 12 organizations that oversee DNS base servers worldwide there isn’t an entity in Russia. Pierluigi Paganini.

article thumbnail

Quad9 to move offices to Switzerland, invites other privacy-focused firms to follow

SC Magazine

.” Quad9 is a non-profit offering a free recursive DNS service that does not log user data. and Google Public DNS. The company received a finding of law from the Swiss government that it will not be treated as a telecommunications provider, exempting it from laws that would mandate data collection. are wary of U.S.

DNS 96
article thumbnail

Group-IB presents its annual report on global threats to stability in cyberspace

Security Affairs

The past months have shown that the most dangerous hacks involved DNS hijacking, which helped attackers manipulate DNS records for MITM attacks. The most common objective of such attacks is cyberespionage and disruption of major telecommunications companies’ work. The telecommunications sector: Are providers ready for 5G?

Banking 82
article thumbnail

APT trends report Q1 2021

SecureList

Although Lyceum still prefers taking advantage of DNS tunneling, it appears to have replaced the previously documented.NET payload with a new C++ backdoor and a PowerShell script that serve the same purpose. The victims we observed were all high-profile Tunisian organizations, such as telecommunications or aviation companies.

Malware 139