Loading story…
CubePilot, an Australian drone flight controller manufacturer, disclosed that attackers hijacked DNS settings for its cubepilot.org domain, redirected users to attacker-controlled infrastructure, and obtained valid TLS certificates for all subdomains. The compromise created a credible risk that credentials and other sensitive traffic entered into services such as the company portal and forum could have been intercepted while still appearing to use legitimate HTTPS connections.
CubePilot said it regained control of the domain the same day, revoked the fraudulent certificates, preserved evidence, and reported the incident to the Australian Cyber Security Centre and law enforcement. As a precaution, the company took OEM services, its community forum, documentation portal, and ERP-related services offline, warned customers not to flash firmware downloaded between July 24 and July 25 until integrity checks are completed, and advised customers to verify any payment requests claiming to be from the company by phone.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
As a precaution after the DNS hijacking, CubePilot took multiple services offline, including OEM services, the community forum, and documentation resources. The company also warned customers not to flash firmware downloaded on July 24–25 until integrity checks are completed and to verify payment requests claiming to be from CubePilot by phone.
CubePilot said it regained control of the cubepilot.org domain on the same day as the attack and revoked the fraudulent TLS certificates. The company also preserved evidence and reported the incident to the Australian Cyber Security Centre and law enforcement.
On July 24, attackers gained unauthorized control of CubePilot's cubepilot.org DNS settings, redirected traffic to attacker-controlled infrastructure, and obtained TLS certificates for all subdomains. The incident created a risk of intercepted traffic and credential capture while still presenting valid HTTPS connections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA warned that **PX4 Autopilot** contains a critical vulnerability, `CVE-2026-1579`, that can let an unauthenticated attacker execute arbitrary shell commands through the **MAVLink** interface. The flaw affects `PX4 Autopilot v1.16.0_SITL_latest_stable` and stems from MAVLink not requiring cryptographic authentication by default, allowing attackers with interface access to send `SERIAL_CONTROL` messages that could alter flight paths, crash drones, intercept data, or lock out legitimate operators. CISA rated the issue **CVSS 9.8** and mapped it to **CWE-306: Missing Authentication for Critical Function**. The advisory said PX4 supports **MAVLink 2.0 message signing** as its authentication mechanism, and unsigned messages are rejected when signing is enabled. The vulnerability was reported by **Dolev Aviv of Cyviation**, and CISA said it had no evidence of public exploitation at publication. Because PX4 is used in drones and autonomous vehicles deployed worldwide, the agency said the exposure could affect **Transportation Systems, Emergency Services, and the Defense Industrial Base**, and urged organizations to reduce network exposure, isolate control systems behind firewalls, use secure remote access such as updated VPNs, assess operational risk before changes, train personnel against phishing, and apply vendor fixes when available.
Jun 29, 2026
CISA and Mandiant reported a global **DNS infrastructure hijacking** campaign in which attackers used compromised DNS-management credentials to alter victim **A**, **MX**, and **NS** records, redirecting web and email traffic to attacker-controlled systems. The activity affected dozens of domains linked to government, telecommunications, and internet infrastructure organizations across the Middle East and North Africa, Europe, and North America, enabling interception, manipulation, and man-in-the-middle access to sensitive communications. Investigators said the campaign operated at scale over an extended period and in some cases allowed the attackers to obtain valid **TLS certificates** for victim domains, letting them decrypt redirected traffic without triggering browser warnings. Mandiant said the infrastructure and access patterns suggest a likely nexus to Iran and alignment with Iranian government interests, while noting the activity may involve multiple operational clusters. CISA urged organizations to reset DNS account passwords, enable **multifactor authentication**, audit public DNS records, and revoke any fraudulent certificates tied to affected domains.
Aug 15, 2026
Authorities and private-sector partners disrupted an **APT28** campaign known as **FrostArmada** that hijacked DNS traffic on compromised SOHO routers to steal Microsoft 365 credentials and OAuth tokens. Investigators said the operation abused **MikroTik**, **TP-Link**, some **Nethesis**, and older **Fortinet** devices, redirecting authentication traffic through attacker-controlled VPS infrastructure to perform adversary-in-the-middle interception. Microsoft and Lumen Black Lotus Labs traced the activity, identified victims, and supported action by the **FBI**, the **U.S. Department of Justice**, and Polish authorities to take malicious infrastructure offline. At its peak in December 2025, the campaign had infected about **18,000 devices in 120 countries** and affected government agencies, law enforcement, IT and hosting providers, and organizations running their own servers. The disruption comes amid broader warnings that Russia-linked **Fancy Bear**—also tracked as **APT28**, **Forest Blizzard**, and **Pawn Storm**—continues global cyber-espionage and disruptive operations. Recent reporting tied the group not only to router-based DNS hijacking, including abuse of TP-Link devices and exploitation of **`CVE-2023-50224`**, but also to **NTLMv2** hash relay attacks leveraging Outlook flaw **`CVE-2023-23397`** and malware activity targeting Ukraine’s defense supply chain and allied countries. Security guidance from Microsoft, the UK NCSC, researchers, and government agencies urged organizations to harden routers, patch internet-facing systems, enable MFA, reduce external exposure, remove end-of-life equipment, and adopt certificate pinning and zero-trust controls to limit credential theft and follow-on compromise.
Jun 29, 2026