DNS Infrastructure Hijacking Campaign

The NCCIC reports it is aware of a global Domain Name System (DNS) infrastructure hijacking campaign. Using compromised credentials, an attacker can modify the location to which an organization’s domain name resources resolves. This enables the attacker to redirect user traffic to attacker-controlled infrastructure and obtain valid encryption certificates for an organization’s domain names, enabling man-in-the-middle attacks. The NCCIC encourages administrators to review FireEye’s blog on global DNS infrastructure hijacking for more information. Additionally, the NCCIC recommends a series of best practices to help safeguard networks against this threat. Read the full advisory at NCCIC/US-CERT.