Remove DNS Remove Technology Remove Telecommunications
article thumbnail

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

Krebs on Security

” The DNS part of that moniker refers to the global “ D omain N ame S ystem ,” which serves as a kind of phone book for the Internet by translating human-friendly Web site names (example.com) into numeric Internet address that are easier for computers to manage. PASSIVE DNS.

DNS 271
article thumbnail

ICANN warns of large-scale attacks on Internet infrastructure

Security Affairs

. “The Internet Corporation for Assigned Names and Numbers ( ICANN ) believes that there is an ongoing and significant risk to key parts of the Domain Name System ( DNS ) infrastructure. “They are going after the internet infrastructure itself,” ICANN chief technology officer David Conrad told AFP. Pierluigi Paganini.

Internet 111
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Sunburst: connecting the dots in the DNS requests

SecureList

In the initial phases, the Sunburst malware talks to the C&C server by sending encoded DNS requests. These requests contain information about the infected computer; if the attackers deem it interesting enough, the DNS response includes a CNAME record pointing to a second level C&C server. Low-level details. avsvmcloud[.]com”

DNS 75
article thumbnail

Lyceum group reborn

SecureList

As in the older DanBot instances, both variants supported similar custom C&C protocols tunneled over DNS or HTTP. Our investigation into Lyceum has shown that the group has evolved its arsenal over the years and shifted its usage from the previously documented.NET malware to new versions, written in C++.

DNS 129
article thumbnail

ExCobalt Cybercrime group targets Russian organizations in multiple sectors

Security Affairs

Positive Technologies researchers reported that a cybercrime gang called ExCobalt targeted Russian organizations in multiple sectors with a previously unknown Golang-based backdoor known as GoRed. For secure communication, operators employ DNS/ICMP tunneling, WSS, and QUIC protocols.

article thumbnail

Russian Sandworm APT impersonates Ukrainian telcos to deliver malware

Security Affairs

Russia-linked APT group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. Russia-linked cyberespionage group Sandworm has been observed impersonating telecommunication providers to target Ukrainian entities with malware. ” reads the report published by Recorded Future.

Malware 104
article thumbnail

Iran-linked APT34: Analyzing the webmask project

Security Affairs

Security expert Marco Ramilli published the findings of a quick analysis of the webmask project standing behind the DNS attacks implemented by APT34 (aka OilRig and HelixKitten ). The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries.

DNS 107