Loading story…
Researchers disclosed Underminr, a CDN abuse technique that allows attackers to conceal malicious connections behind trusted, high-reputation domains hosted on shared content delivery infrastructure. Unlike classic domain fronting, the method relies on a legitimate DNS lookup to an allowed domain that resolves to a shared CDN IP, while the actual connection presents the blocked destination in the TLS SNI field and HTTP Host header, enabling cross-tenant routing that many defenses fail to detect. ADAMnetworks said it has already observed insider threats using the technique to bypass controls, and warned it could support command-and-control traffic, malware delivery, phishing, data exfiltration, and access to malicious sites.
The issue is being described as an architectural weakness rather than a software flaw, with no CVE and no simple patch. ADAMnetworks' analysis of nearly 5 million Tranco-ranked websites across 73 CDN providers found roughly 42% of domains and 33 providers were susceptible, while broader estimates suggested the exposure could extend to more than 88 million domains across major platforms including Cloudflare, Akamai, AWS CloudFront, and Fastly. Researchers and defenders recommended deep packet inspection, validating SNI and Host header consistency, monitoring unusual traffic to reputable domains, reviewing CDN tenant isolation, and working with providers; ADAMnetworks also released a lookup tool for domain owners and an open-source monitoring tool called Outminr.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
ADAMnetworks said the Underminr technique aligns with tunneling-style tradecraft and noted associations with China-aligned actors including Flax Typhoon and GALLIUM. The report also described four attack modes—Simple, Split, ECH, and Direct-to-IP—showing how the technique can support command-and-control, exfiltration, VPN tunneling, and policy evasion.
Follow-on reporting said Underminr is an architectural abuse issue rather than a software bug, with no CVE assigned and no simple patch available as of May 2026. The reporting said the technique could affect more than 88 million domains across major providers including Cloudflare, Akamai, AWS CloudFront, and Fastly.
Alongside its disclosure, ADAMnetworks released a lookup tool for domain owners and an open-source monitoring tool called Outminr to help identify and monitor exposure to the cross-tenant routing issue. It also advised organizations to use non-susceptible CDN providers or pressure providers to mitigate the problem.
ADAMnetworks publicly disclosed Underminr, a CDN architectural abuse technique similar to domain fronting that can conceal malicious traffic by combining an allowed DNS lookup with a disallowed SNI and HTTP Host target. Its analysis of nearly 5 million Tranco-ranked websites across 73 CDN providers found roughly 42% of domains and 33 providers were susceptible.
ADAMnetworks said it had already seen insider threats use the Underminr technique to bypass protections by hiding malicious connections through shared CDN and hosting infrastructure. The exact date was not provided in the references.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered two large-scale malicious infrastructures that used Cloudflare-fronted domains and wildcard subdomains to hide centralized backend systems. In one campaign, investigators traced an **adversary-in-the-middle (AiTM)** phishing operation from four suspicious domains to at least seven domains and more than **200 subdomains** impersonating enterprise **VPN** and **SSO** portals, including Palo Alto GlobalProtect, Fortinet FortiGate, Cisco AnyConnect, Citrix, and Microsoft OWA. The phishing flow presented fake Cloudflare challenge pages before credential prompts, and the infrastructure was linked to a single origin server at `178.16.53.131` in Germany. Researchers said the platform could relay live authentication sessions and steal both credentials and session tokens, allowing attackers to bypass traditional MFA protections. A separate investigation tied a single ClearFake indicator to a broader malware delivery network spanning **24 `.in.net` domains**, more than **100 subdomains**, two Cloudflare account clusters, and a shared **WebDAV** origin server. Analysts found wildcard DNS and TLS certificates across the domains, identical `ETag` values indicating common hosting, and an exposed payload inventory accessible through unauthenticated WebDAV requests. The campaign used compromised websites to redirect victims to fake verification pages and then delivered malicious DLLs and two newly identified obfuscated Go binaries disguised as Logitech and Intel components. Breakglass reported that the recovered payloads had **zero detections** in VirusTotal and MalwareBazaar at the time of discovery, while multiple OPSEC mistakes—including leaked headers, an exposed staging directory, and a recurring "werification" typo—helped map the operation.
Jun 29, 2026
PortSwigger research warns that ambiguous HTTP/1.1 request boundaries continue to enable HTTP request-smuggling, or desynchronization, attacks across tens of millions of websites. The research introduced new desynchronization classes, reported critical exposure in major CDN infrastructure, and has been associated with compromises of three major CDNs and more than $350,000 in bug-bounty awards despite years of mitigations. One variant, **0.CL**, arises when a front end and back end disagree over a malformed or zero `Content-Length` header: the front end may forward a request without a body while the back end waits for one. Attackers can exploit an early-response endpoint to cause the back end to consume bytes from a following request, enabling queue poisoning and potentially cross-site scripting against another user. Organizations should eliminate HTTP/1.1 from proxy-to-origin paths where feasible by deploying HTTP/2 or later end to end, and continuously test any remaining HTTP/1.1 intermediaries for parser discrepancies.
Sep 3, 2026
Palo Alto Networks Unit 42 reported that a large share of malware command-and-control traffic is avoiding DNS-based detection by connecting directly to IP addresses. In an analysis of more than 4 million dynamic malware reports collected over 30 days, 20.11% of samples showed C2 activity, and 45.32% of those samples made at least one direct-to-IP connection. Those direct connections accounted for 23.17% of all observed C2 attempts, indicating that DNS-focused controls can miss a substantial portion of malicious outbound traffic. The research linked this technique to multiple active threats, including **Phorpiex** ransomware droppers using hard-coded IP infrastructure, an obfuscated `\GET` data-exfiltration campaign hosted on Brazilian public cloud infrastructure, **SectopRAT** activity targeting educational institutions, and IoT botnets such as **Mozi** and a Mirai variant known as **Boatnet**. Unit 42 said the findings support a **Zero Trust IP** enforcement model that permits outbound connections only to IP addresses previously validated through trusted DNS resolution, aiming to close a visibility gap exploited by malware that communicates outside normal domain-based controls.
Aug 5, 2026