Loading story…
CISA and Mandiant reported a global DNS infrastructure hijacking campaign in which attackers used compromised DNS-management credentials to alter victim A, MX, and NS records, redirecting web and email traffic to attacker-controlled systems. The activity affected dozens of domains linked to government, telecommunications, and internet infrastructure organizations across the Middle East and North Africa, Europe, and North America, enabling interception, manipulation, and man-in-the-middle access to sensitive communications.
Investigators said the campaign operated at scale over an extended period and in some cases allowed the attackers to obtain valid TLS certificates for victim domains, letting them decrypt redirected traffic without triggering browser warnings. Mandiant said the infrastructure and access patterns suggest a likely nexus to Iran and alignment with Iranian government interests, while noting the activity may involve multiple operational clusters. CISA urged organizations to reset DNS account passwords, enable multifactor authentication, audit public DNS records, and revoke any fraudulent certificates tied to affected domains.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos reported that the Sea Turtle campaign continued operating after earlier public exposure, using new infrastructure and a DNS hijacking method that changed victims’ name server records to actor-controlled servers for credential-theft man-in-the-middle attacks. Talos also linked Sea Turtle to the compromise of ICS-Forth, manager of Greece’s .gr registry, and assessed that this access enabled hijacking against additional Greek government entities.
NCCIC revised the alert again and updated the downloadable open-source indicators of compromise. The February 13 update removed three non-malicious IP addresses: 107.161.23.204, 192.161.187.200, and 209.141.38.71.
NCCIC revised its DNS hijacking campaign notice to update indicators of compromise and add a referenced CrowdStrike blog on widespread DNS hijacking activity. This was the first documented revision to the alert after its initial publication.
NCCIC said it was aware of a global DNS infrastructure hijacking campaign in which attackers used compromised credentials to alter DNS records and redirect web and mail traffic to attacker-controlled infrastructure. The alert included mitigation advice such as resetting DNS-management passwords, enabling MFA, auditing DNS records, and revoking fraudulent certificates.
Mandiant reported multiple non-overlapping clusters of DNS hijacking activity affecting dozens of domains tied to government, telecommunications, and internet infrastructure organizations in the Middle East and North Africa, Europe, and North America. The activity was observed from January 2017 through January 2019.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourceblog.talosintelligence.com
Open sourceus-cert.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Infoblox researchers reported a widespread **DNS hijacking** campaign targeting **outdated consumer/home routers** across **more than three dozen countries**, where attackers compromise devices and change router-level DNS settings to silently redirect all connected users’ traffic. The manipulated DNS queries are sent to malicious resolvers hosted by **Aeza International**, a **Russian bulletproof hosting provider** that the US sanctioned in **July 2025**, allowing threat actors to control where victims are routed while keeping common destinations working to reduce suspicion. The infrastructure reportedly uses a **two-stage redirection chain**: DNS traffic is forwarded into an **HTTP-based Traffic Distribution System (TDS)** that first verifies the request originates from a compromised router and then fingerprints/filters victims before sending them onward—often into **advertising/affiliate networks** that can lead to **scams or malicious sites**. Analysts also described an evasion behavior where the rogue resolvers may only respond under specific query conditions (e.g., when **EDNS0** is disabled), complicating reproduction and detection; user-visible symptoms included selective site failures and persistent redirects that victims often misattributed to endpoints rather than the router.
Jun 29, 2026
Authorities and private-sector partners disrupted an **APT28** campaign known as **FrostArmada** that hijacked DNS traffic on compromised SOHO routers to steal Microsoft 365 credentials and OAuth tokens. Investigators said the operation abused **MikroTik**, **TP-Link**, some **Nethesis**, and older **Fortinet** devices, redirecting authentication traffic through attacker-controlled VPS infrastructure to perform adversary-in-the-middle interception. Microsoft and Lumen Black Lotus Labs traced the activity, identified victims, and supported action by the **FBI**, the **U.S. Department of Justice**, and Polish authorities to take malicious infrastructure offline. At its peak in December 2025, the campaign had infected about **18,000 devices in 120 countries** and affected government agencies, law enforcement, IT and hosting providers, and organizations running their own servers. The disruption comes amid broader warnings that Russia-linked **Fancy Bear**—also tracked as **APT28**, **Forest Blizzard**, and **Pawn Storm**—continues global cyber-espionage and disruptive operations. Recent reporting tied the group not only to router-based DNS hijacking, including abuse of TP-Link devices and exploitation of **`CVE-2023-50224`**, but also to **NTLMv2** hash relay attacks leveraging Outlook flaw **`CVE-2023-23397`** and malware activity targeting Ukraine’s defense supply chain and allied countries. Security guidance from Microsoft, the UK NCSC, researchers, and government agencies urged organizations to harden routers, patch internet-facing systems, enable MFA, reduce external exposure, remove end-of-life equipment, and adopt certificate pinning and zero-trust controls to limit credential theft and follow-on compromise.
Jun 29, 2026
An Iran-linked threat actor conducted a password-spraying campaign against Microsoft 365 tenants, hitting more than 300 organizations in Israel and over 25 in the United Arab Emirates, with additional targeting in Europe, the United States, the United Kingdom, and Saudi Arabia. Check Point said the activity unfolded in three waves on March 3, 13, and 23 and primarily targeted municipalities, government bodies, energy and transportation organizations, technology firms, and other private-sector cloud environments. The attackers relied on weak passwords and exposed cloud accounts rather than malware or software exploits, using rotating Tor exit nodes and a spoofed Internet Explorer 10 on Windows 7 user agent during reconnaissance before shifting successful logins to commercial VPN infrastructure, including services associated with Windscribe and NordVPN, geolocated in Israel. Researchers said the intrusions led to access to email, documents, administrative tools, and in some cases mailbox data exfiltration. Check Point assessed the activity with moderate confidence as Iran-linked and noted similarities to **Gray Sandstorm**, while also tying parts of the infrastructure to `AS35758`, which has been associated with recent Iran-nexus operations. Israeli municipalities were identified as a primary focus, and the campaign may have supported broader operational objectives such as damage assessment tied to regional military activity. Defenders were urged to review sign-in logs for distributed authentication failures, enforce tenant-wide MFA, strengthen password policies, apply location-based access controls, block Tor where feasible, and retain audit logs for investigation.
Jun 29, 2026