Loading story…
Silent Push disclosed research dubbed DangleGeddon showing that AI can sharply accelerate dangling DNS takeover attacks, in which a DNS record continues pointing to a deleted cloud resource and an attacker recreates that resource to seize the subdomain. Using Claude Opus 5 and automated workflows, the researchers said they processed roughly 12,500 domains, narrowed them to several hundred viable targets, and reached a stage where exploitation could be launched with minimal additional effort.
The testing was conducted as a safe proof of concept and affected organizations were notified rather than exploited, but the exposed records reportedly included a U.S. federal government domain as well as assets tied to Société Générale, Ford, and Eli Lilly. Silent Push warned that compromised subdomains could be used for phishing, malware delivery, credential harvesting, and other targeted abuse, and said AI-enabled automation could let nation-state or criminal operators weaponize forgotten DNS records at global scale across government, banking, manufacturing, and pharmaceutical sectors.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Silent Push researchers documented a campaign they call “DangleGeddon,” showing that AI-assisted workflows could automate discovery, filtering, script generation, and infrastructure setup for dangling DNS takeovers at large scale. In their testing, they targeted 12,500 domains, narrowed them to several hundred exploitable candidates, and demonstrated that exploitation could be prepared with minimal effort.
During the DangleGeddon research, Silent Push conducted safe validation tests on exposed dangling DNS records and notified affected organizations instead of abusing the vulnerable subdomains. Examples cited include a U.S. federal government domain, Société Générale, Ford, and Eli Lilly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityweek.com
Open sourcesilentpush.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA and Mandiant reported a global **DNS infrastructure hijacking** campaign in which attackers used compromised DNS-management credentials to alter victim **A**, **MX**, and **NS** records, redirecting web and email traffic to attacker-controlled systems. The activity affected dozens of domains linked to government, telecommunications, and internet infrastructure organizations across the Middle East and North Africa, Europe, and North America, enabling interception, manipulation, and man-in-the-middle access to sensitive communications. Investigators said the campaign operated at scale over an extended period and in some cases allowed the attackers to obtain valid **TLS certificates** for victim domains, letting them decrypt redirected traffic without triggering browser warnings. Mandiant said the infrastructure and access patterns suggest a likely nexus to Iran and alignment with Iranian government interests, while noting the activity may involve multiple operational clusters. CISA urged organizations to reset DNS account passwords, enable **multifactor authentication**, audit public DNS records, and revoke any fraudulent certificates tied to affected domains.
Aug 15, 2026
Analysis of the SolarWinds **SUNBURST** backdoor showed that DNS traffic to `avsvmcloud.com` was used not just for beaconing but as a bidirectional command-and-control channel that exfiltrated victim information from trojanized Orion deployments. Researchers found the malware encoded internal hostnames, Active Directory domain names, victim identifiers, and the status of some installed endpoint security products into DNS subdomains, with longer hostnames split across multiple queries and later reassembled. Public passive DNS analysis linked the campaign to victims including municipal and private-sector organizations, and recovered telemetry indicating environments running products such as **Windows Defender, ESET, CrowdStrike Falcon, Carbon Black,** and **FireEye**. Further research showed that SUNBURST operators used DNS responses to decide whether an infected host would keep beaconing, stop communicating, or advance to later targeting stages that led to `CNAME` redirection and HTTPS-based follow-on command-and-control. The campaign’s infrastructure also illustrated the value of monitoring **strategically aged domains**: `avsvmcloud.com` had been registered well before malicious traffic surged, and burst patterns in passive DNS later became a model for detecting similar APT, phishing, and cloaking infrastructure. Defensive reporting tied the backdoor to broader post-compromise activity including lateral movement, credential theft, and abuse of cloud identity systems such as Azure AD.
Aug 15, 2026
Researchers uncovered two large-scale malicious infrastructures that used Cloudflare-fronted domains and wildcard subdomains to hide centralized backend systems. In one campaign, investigators traced an **adversary-in-the-middle (AiTM)** phishing operation from four suspicious domains to at least seven domains and more than **200 subdomains** impersonating enterprise **VPN** and **SSO** portals, including Palo Alto GlobalProtect, Fortinet FortiGate, Cisco AnyConnect, Citrix, and Microsoft OWA. The phishing flow presented fake Cloudflare challenge pages before credential prompts, and the infrastructure was linked to a single origin server at `178.16.53.131` in Germany. Researchers said the platform could relay live authentication sessions and steal both credentials and session tokens, allowing attackers to bypass traditional MFA protections. A separate investigation tied a single ClearFake indicator to a broader malware delivery network spanning **24 `.in.net` domains**, more than **100 subdomains**, two Cloudflare account clusters, and a shared **WebDAV** origin server. Analysts found wildcard DNS and TLS certificates across the domains, identical `ETag` values indicating common hosting, and an exposed payload inventory accessible through unauthenticated WebDAV requests. The campaign used compromised websites to redirect victims to fake verification pages and then delivered malicious DLLs and two newly identified obfuscated Go binaries disguised as Logitech and Intel components. Breakglass reported that the recovered payloads had **zero detections** in VirusTotal and MalwareBazaar at the time of discovery, while multiple OPSEC mistakes—including leaked headers, an exposed staging directory, and a recurring "werification" typo—helped map the operation.
Jun 29, 2026