Tag: dns
-
Week in review: Fortibleed campaign’s impact on orgs, Cisco Unified CM flaw exploited
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Encrypted DNS still tells an eavesdropper where to look Encrypted DNS runs … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/28/week-in-review-fortibleed-campaigns-impact-on-orgs-cisco-unified-cm-flaw-exploited/
-
Encrypted DNS still tells an eavesdropper where to look
Encrypted DNS runs across much of the Internet. DNS over TLS, HTTPS, and QUIC keep the contents of a query away from anyone watching a network link. The encryption covers the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/22/research-encrypted-dns-privacy/
-
163 Organizations Hit by Thai Gambling SEO Poisoning Campaign
A large-scale Thai gambling SEO poisoning operation has compromised 163 organizations across more than 30 countries by exploiting abandoned cloud DNS delegations, according to research from Cyble Research & Intelligence Labs (CRIL). First seen on thecyberexpress.com Jump to article: thecyberexpress.com/thai-gambling-seo-poisoning/
-
Hackers Use Residential Proxies Networks to Evade Detection
The impact of residential proxies across our customer base by compiling billions of DNS resolutions and the associated network telemetry. The Kimwolf Botnet inside our enterprise customer networks. Follow”‘up analysis of billions of DNS resolutions across Infoblox Threat Defense Cloud customers reveals a more systemic problem: in 2026 more than 65% of customers queried domains associated with residential…
-
Silent Ransom Group (SRG): Switching To DNS Fast Flux Infrastructure
Tags: attack, cybersecurity, data-breach, dns, group, infrastructure, intelligence, law, malicious, network, ransomResearchers exposed the Silent Ransom Group ‘s Fast Flux infrastructure as the FBI warns of ongoing attacks targeting U.S. law firms and businesses. Resecurity uncovered the Silent Ransom Group (SRG)’s Fast Flux network infrastructure and shares available intelligence with the cybersecurity community to disrupt their malicious activities and enable ISP/DNS providers to counter this threat.…
-
Silent Ransom Group (SRG): Uncovering DNS Fast Flux Infrastructure
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/silent-ransom-group-srg-uncovering-dns-fast-flux-infrastructure
-
Über Underminr umgehen Angreifer die DNS-Filterung – 88 Millionen Domains angreifbar durch CDN-Routing-Schwäche
Tags: dnsFirst seen on security-insider.de Jump to article: www.security-insider.de/underminr-cdn-routing-schwaeche-dns-filterung-88-millionen-domains-a-13c83577c0d4ea3e0467ee04b884a444/
-
DNS-AID lets AI agents find and verify each other through DNS
AI agents run across many platforms, and each one needs a way to locate and confirm the identity of the others it works with. The Linux Foundation’s DNS-AID project … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/01/dns-aid-ai-agent-discovery-dns/
-
Single-Letter Go Module Typosquat Drops DNS-Based Backdoor
A newly uncovered software supply chain attack targeting Go developers demonstrates how a single-character typo can silently introduce a persistent backdoor. A malicious Go module, github.com/shopsprint/decimal, designed to impersonate the widely trusted github.com/shopspring/decimal library used for high-precision arithmetic in financial and analytics applications. The legitimate package is heavily adopted across the Go ecosystem, with more than 38,000 known…
-
Expired domain leads to supply chain attack on node-ipc npm package
require(‘node-ipc’). The trojanized versions were designed to remain fully functional to avoid immediate detection, which together with other decisions attackers took, such as data exfiltration via DNS TXT, suggest stealthiness was a top priority.Once executed, the malicious code collects information about the host system, including operating system version, hostname, and environment variables. It then starts…
-
Windows DNS Client Security Flaw Exposes Systems to Remote Code Execution
Windows systems worldwide are at risk from a new critical flaw in the Windows DNS Client that could allow remote code execution without any user interaction. Tracked as CVE-2026-41096, the vulnerability has been rated critical with a CVSS base score of 9.8. It is patched in Microsoft’s May 12, 2026, security updates. Critical DNS client…
-
Six new dnsmasq vulnerabilities open the door to DNS cache poisoning, local root
Recent disclosures have revealed that open-source networking tool dnsmasq is grappling with a serious set of vulnerabilities. The problems span memory safety and input … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/12/dnsmasq-vulnerabilities-cve/
-
Unplug your way to better code
Cybersecurity concepts, logs, packets, DNS exfiltration, and more, are usually intangible, and its practitioners are prone to mental fatigue, Amy takes a second to yell at you to go touch grass. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/unplug-your-way-to-better-code/
-
ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days, Patch-or-Die Alerts and 25+ New Stories
Bad week.Turns out the easiest way to get hacked in 2026 is still the same old garbage: shady packages, fake apps, forgotten DNS junk, scam ads, and stolen logins getting dumped into Discord channels like it’s normal. Some of these attack chains don’t even feel sophisticated anymore. More like some tired guy with a Telegram…
-
The Winter Games effect: When gold meets DDoS
Tags: attack, botnet, cctv, ddos, defense, detection, dns, government, group, infrastructure, international, Internet, iot, jobs, lockbit, network, penetration-testing, ransomware, router, service, strategy, threat, windowsAttack volumes 610x historical levels during the Winter Games period (February 623, 2026)Peak attack count reached more than 2,200 attacks on February 23NoName057(16) dominated public DDoS hacktivist claims with 47, although ransomware groups (Qilin, LockBit 5.0) also claimed success in various attacksTactical shift from pre-Winter Games high-bandwidth attacks (412.89Gbps peak) to Winter Games-period high-throughput attacksGeographic…
-
Fehlerhafte Signatur: Viele .de-Domains durch DNSSEC-Panne lahmgelegt
Tags: dnsEine DNS-Störung hat in der vergangenen Nacht viele teils stark besuchte .de-Domains beeinträchtigt. Der Fehler lag wohl bei der Denic. First seen on golem.de Jump to article: www.golem.de/news/fehlerhafte-signatur-viele-de-domains-durch-dnssec-panne-lahmgelegt-2605-208352.html
-
.de-Domains nicht erreichbar Update 3 Probleme bei der DENIC legten deutsche Internetseiten lahm
Höchstwahrscheinlich Probleme bei der DENIC legen zur Stunde deutsche Internet-Domains (.de) lahm. Nur DNS-Auflösungen im Cache helfen. First seen on computerbase.de Jump to article: www.computerbase.de/news/internet/de-domains-nicht-erreichbar-probleme-bei-der-denic-legen-deutsche-internetseiten-lahm.97210
-
.de-Domains nicht erreichbar Update 2 Probleme bei der DENIC legen deutsche Internetseiten lahm
Höchstwahrscheinlich Probleme bei der DENIC legen zur Stunde deutsche Internet-Domains (.de) lahm. Nur DNS-Auflösungen im Cache helfen. First seen on computerbase.de Jump to article: www.computerbase.de/news/internet/de-domains-nicht-erreichbar-probleme-bei-der-denic-legen-deutsche-internetseiten-lahm.97210
-
Multiple Exim Mail Server Vulnerabilities Could Trigger Crashes via Malicious DNS Data
The developers of the Exim mail server have officially rolled out version 4.99.2 to address four newly discovered security vulnerabilities. This critical update patches multiple software flaws that could allow attackers to crash server connections, corrupt memory heaps, or potentially leak sensitive system data. Mail server administrators are strongly advised to apply these fixes immediately…
-
Open-source IPFire DNS Firewall blocks malware and phishing at the resolver
The IPFire project shipped Core Update 201 for its 2.29 release line, bringing DNS-layer domain blocking into the open-source firewall distribution. The update replaces two … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/28/open-source-ipfire-dns-firewall/
-
Open-source IPFire DNS Firewall blocks malware and phishing at the resolver
The IPFire project shipped Core Update 201 for its 2.29 release line, bringing DNS-layer domain blocking into the open-source firewall distribution. The update replaces two … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/28/open-source-ipfire-dns-firewall/
-
TDL 020 – Why DNS Is Your First Line of Cyber Defense – Chris Buijs
Tags: access, attack, automation, business, cisco, ciso, cloud, container, corporate, country, cyber, cybersecurity, data, ddos, defense, dns, encryption, endpoint, finance, firewall, group, hacker, ibm, infrastructure, Internet, iot, jobs, malicious, microsoft, network, office, phone, programming, router, saas, service, software, startup, strategy, switch, technology, threat, tool, training, update, usa, vulnerability, zero-trustIn Episode 20 of The Defender’s Log, host David Redekop sits down with Amsterdam-based tech veteran Chris Buijs to discuss the often-overlooked backbone of internet security: DNS (Domain Name System). The “Set-it-and-Forget-it” Trap Buijs, who transitioned from an electrician to a network architect, notes that many organizations treat DNS as a “utility” rather than a…
-
TDL 020 – Why DNS Is Your First Line of Cyber Defense – Chris Buijs
Tags: access, attack, automation, business, cisco, ciso, cloud, container, corporate, country, cyber, cybersecurity, data, ddos, defense, dns, encryption, endpoint, finance, firewall, group, hacker, ibm, infrastructure, Internet, iot, jobs, malicious, microsoft, network, office, phone, programming, router, saas, service, software, startup, strategy, switch, technology, threat, tool, training, update, usa, vulnerability, zero-trustIn Episode 20 of The Defender’s Log, host David Redekop sits down with Amsterdam-based tech veteran Chris Buijs to discuss the often-overlooked backbone of internet security: DNS (Domain Name System). The “Set-it-and-Forget-it” Trap Buijs, who transitioned from an electrician to a network architect, notes that many organizations treat DNS as a “utility” rather than a…
-
3 practical ways AI threat detection improves enterprise cyber resilience
Legitimate admin activity and malicious behavior often look similar without contextHybrid environments generate fragmented telemetry that rule sets can’t correlateLean teams don’t have time to manually connect the dots across systemsPlatforms like Adlumin MDR apply behavioral models and automated triage to suppress low”‘value alerts and elevate incidents that actually matter. Fewer alerts, better context, and…
-
3 practical ways AI threat detection improves enterprise cyber resilience
Legitimate admin activity and malicious behavior often look similar without contextHybrid environments generate fragmented telemetry that rule sets can’t correlateLean teams don’t have time to manually connect the dots across systemsPlatforms like Adlumin MDR apply behavioral models and automated triage to suppress low”‘value alerts and elevate incidents that actually matter. Fewer alerts, better context, and…
-
Global S3: Another C2 Channel for AgentCore Code Interpreters
Introduction Building on recent research identifying DNS-based exfiltration risks in Sandbox mode AgentCore Code Interpreters, I identified global S3 access as another Command & Control channel for sandboxed code interpreters. Unlike DNS-based exfiltration, which has since been fully mitigated, S3 access is a useful and fully-documented feature of AgentCore code interpreters that nevertheless creates a……
-
Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles
Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that’s distributed via a theme related to India’s banking sector.”The backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management, indicating a continued espionage-focused capability set rather than First seen on thehackernews.com…
-
What is DANE? DNS-Based Authentication of Named Entities Explained (2026)
DANE (DNS-Based Authentication of Named Entities) uses DNSSEC and TLSA records to secure TLS certificates and prevent man-in-the-middle attacks on email and the web. Here’s how it works. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/what-is-dane-dns-based-authentication-of-named-entities-explained-2026/
-
SPF Governance in Enterprise Environments
See how enterprises can improve SPF governance with clearer ownership, structured DNS change processes, and better cross-team alignment. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/spf-governance-in-enterprise-environments/
-
Google Adds Rust-Based DNS Parser into Pixel 10 Modem to Enhance Security
Google has announced the integration of a Rust-based Domain Name System (DNS) parser into the modem firmware as part of its ongoing efforts to beef up the security of Pixel devices and push memory-safe code at a more foundational level.”The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of…