Log in Request a demo

E-Book

DNS Under Siege:Analysis of Threat Actor-Driven Abuse

DNS abuse by threat actors: how attackers hijack DNS records and hide commands in DNS traffic, and what this Brandefense report covers for you.

Brandefense logo Updated 1 Min Read
Earth with digital network and red laser beams representing cyber attacks.

DNS abuse is when threat actors misuse the Domain Name System to attack. CISA describes attackers changing DNS records so an organization’s traffic goes to servers they control. MITRE ATT&CK describes adversaries hiding command and control traffic inside normal DNS queries. This page introduces a report on how threat actors abuse DNS.

What Will You Find in This Report on DNS Abuse by Threat Actors?

Learn Technical Method of Operation Details
The technical details of the fundamentals of the DNS mechanism and its paramount role in facilitating seamless internet communication. This e-book will show all the information on the analysis of DNS.

Gain Knowledge About Future Attacks
By understanding technics, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.

Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. Safeguarding against DNS-based malware attacks requires a multifaceted and proactive approach.

Frequently Asked Questions.

What is DNS abuse by threat actors?

It is the misuse of the Domain Name System for attacks. MITRE ATT&CK describes adversaries using DNS for command and control to blend in with normal traffic. CISA describes attackers changing DNS records to redirect traffic.

How does DNS hijacking work?

CISA describes three steps: attackers compromise credentials of accounts that can change DNS, alter A, MX or NS records to point to infrastructure they control, then obtain valid certificates for the domains so redirected traffic raises no warnings.

What is Fast Flux DNS?

MITRE ATT&CK describes it as hiding a command and control channel behind many rapidly changing IP addresses linked to one domain.

How can organizations reduce the risk of DNS hijacking?

CISA recommends resetting passwords for accounts that manage DNS records, enabling multifactor authentication on registrar and DNS systems, checking that public DNS records resolve to legitimate locations, and revoking fraudulent certificates.

Sources

  1. 1 CISA: DNS Infrastructure Hijacking Campaign (AA19-024A)
  2. 2 MITRE ATT&CK: Application Layer Protocol: DNS (T1071.004)
  3. 3 MITRE ATT&CK: Dynamic Resolution: Fast Flux DNS (T1568.001)
Share

In This Article

TermsThreat actor TermsCommand and control (C2)

Where To Next.

All E-Book Articles
In plain words · Glossary term Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Open → Keep reading · Article Effective YARA Rules for Security Researchers

Learn what YARA rules are, how they are built from strings and conditions, and how security researchers use them to find malware.

Open →

Knowledge HubThreat group profiles