Underminr Lets Attackers Hide Malicious Traffic Behind Trusted CDN Domains

Researchers disclosed Underminr, a CDN abuse technique that allows attackers to conceal malicious connections behind trusted, high-reputation domains hosted on shared content delivery infrastructure. Unlike classic domain fronting, the method relies on a legitimate DNS lookup to an allowed domain that resolves to a shared CDN IP, while the actual connection presents the blocked destination in the TLS SNI field and HTTP Host header, enabling cross-tenant routing that many defenses fail to detect. ADAMnetworks said it has already observed insider threats using the technique to bypass controls, and warned it could support command-and-control traffic, malware delivery, phishing, data exfiltration, and access to malicious sites.

The issue is being described as an architectural weakness rather than a software flaw, with no CVE and no simple patch. ADAMnetworks' analysis of nearly 5 million Tranco-ranked websites across 73 CDN providers found roughly 42% of domains and 33 providers were susceptible, while broader estimates suggested the exposure could extend to more than 88 million domains across major platforms including Cloudflare, Akamai, AWS CloudFront, and Fastly. Researchers and defenders recommended deep packet inspection, validating SNI and Host header consistency, monitoring unusual traffic to reputable domains, reviewing CDN tenant isolation, and working with providers; ADAMnetworks also released a lookup tool for domain owners and an open-source monitoring tool called Outminr.