Tag: dns
-
Dynamic Objects in Active Directory: The Stealthy Threat
Active Directory’s “dynamic objects” feature offers attackers a perfect evasion cloak. These objects automatically self-destruct without a trace, so they allow adversaries to bypass quotas, pollute access lists, and persist in the cloud, leaving forensic investigators with nothing to analyze. Key takeaways The threat: Dynamic objects self-delete without leaving any traces, or “tombstones” in AD…
-
Proaktive Bedrohungsaufklärung und einheitlicher Schutz gewinnen angesichts wachsender Komplexität zunehmend an Bedeutung
Mit Blick auf das zweite Halbjahr 2025 verzeichnet Watchguard Technologies im aktuellen Internet-Security-Report einen rapiden Anstieg evasiver und verschlüsselter Malware. Dieser Trend markiert die Notwendigkeit proaktiver und ganzheitlicher Sicherheitsansätze. Basierend auf anonymisierten, aggregierten Bedrohungsinformationen aus Watchguards Netzwerk-, Endpoint- und DNS-Filter-Lösungen macht der Report deutlich, dass sowohl Volumen als auch Raffinesse von Malware-Angriffen steigen. Dabei werden…
-
Notepad++ author says fixes make update mechanism ‘effectively unexploitable’
Tags: access, attack, backdoor, china, control, credentials, dns, espionage, exploit, group, infrastructure, intelligence, malicious, monitoring, network, risk, risk-management, service, software, supply-chain, threat, ukraine, update, vulnerabilityCSOonline, Ho said that no system can ever be declared absolutely unbreakable, “but the new design dramatically raises the bar.”An attacker must now compromise both the hosting infrastructure and the signing keys, he explained, adding that the updater now validates both the manifest and the installer, each with independent cryptographic signatures. And any mismatch, missing…
-
OVHcloud DNS Integration: Simplify DMARC Deployment Across All Your Domains
Originally published at OVHcloud DNS Integration: Simplify DMARC Deployment Across All Your Domains by EasyDMARC. Managing DNS records across hundreds of domains has … First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/ovhcloud-dns-integration-simplify-dmarc-deployment-across-all-your-domains/
-
ClickFix Attacks Abuses DNS Lookup Command to Deliver ModeloRAT
ClickFix campaigns have adapted to the latest defenses with a new technique to trick users into infecting their own machines with malware. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/clickfix-attacks-dns-lookup-command-modelorat
-
Microsoft alerts on DNS-based ClickFix variant delivering malware via nslookup
Microsoft warns of a new ClickFix variant that tricks users into running DNS commands to fetch malware via nslookup. Microsoft has revealed a new ClickFix variant that deceives users into running a malicious nslookup command through the Windows Run dialog to retrieve a second-stage payload via DNS. ClickFix typically uses fake CAPTCHA or error messages…
-
CleanTalk Plugin for WordPress Exposes Sites to Authorization Bypass via Reverse DNS
A critical vulnerability in the popular CleanTalk Spam Protection plugin for WordPress exposes websites to complete takeover. Tracked as CVE-2026-1490, this high-severity flaw allows unauthenticated attackers to bypass authorization mechanisms and install arbitrary plugins on affected sites. The vulnerability carries a CVSS score of 9.8, indicating immediate danger to website administrators using outdated versions of…
-
Palo Alto Networks Firewall Vulnerability Lets Attackers Trigger Reboot Loops
Palo Alto Networks has disclosed a PAN-OS firewall vulnerability that can let remote attackers force repeated reboots, potentially pushing a device into a “reboot loop” that ends in maintenance mode. Tracked as CVE-2026-0229, the issue sits in the Advanced DNS Security (ADNS) feature. It can be triggered by an unauthenticated attacker using a maliciously crafted…
-
Sanctioned Bulletproof Host Tied to DNS Hijacking
Shadow Aeza International Directed Traffic to Malicious Adtech. A financially motivated threat actor hacked dozens of domain name system resolvers, connecting them to the infrastructure of a Russian bulletproof hosting service sanctioned by the U.S. Department of Treasury for its criminal links, researchers found. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/sanctioned-bulletproof-host-tied-to-dns-hijacking-a-30723
-
Die Vertrauensstellung des Domain Name System wird zum Risiko Tunneling: Der blinde Fleck in der Netzwerksicherheitsstrategie
First seen on security-insider.de Jump to article: www.security-insider.de/dns-tunneling-der-blinde-fleck-in-der-netzwerksicherheitsstrategie-a-d628faf43c2a7f0dd37e8eb0939f8933/
-
Sanctioned Bulletproof Host Linked to Hijacking of Old Home Routers
Compromised home routers in 30+ countries had DNS traffic redirected, sending users to malicious sites while normal browsing appeared unaffected. First seen on hackread.com Jump to article: hackread.com/sanctioned-bulletproof-host-hijack-old-home-routers/
-
Shadow DNS Operation Abuses Compromised Routers to Manipulate Internet Traffic
A sophisticated shadow DNS network that hijacks internet traffic by compromising home and business routers. The operation, active since mid-2022, manipulates DNS resolution through malicious resolvers hosted by Aeza International (AS210644), a bulletproof hosting provider sanctioned by the U.S. Treasury Department in July 2025. The threat campaign targets older router models, modifying their DNS configuration…
-
Top 10 Best DNS Filtering Solutions 2026
In 2026, the perimeter is gone. Your users are everywhere, and the >>castle and moat<< security model is obsolete. The most effective way to secure a hybrid workforce is through DNS filtering and Secure Access Service Edge (SASE). These tools act as the new control plane, stopping ransomware command-and-control (C2) callbacks and AI-driven phishing attacks…
-
APT Attacks Target Indian Government Using SHEETCREEP, FIREPOWER, and MAILCREEP – Part 2
Tags: access, ai, api, apt, attack, backdoor, backup, cloud, control, credentials, data, dns, email, exploit, github, google, government, group, india, infection, infrastructure, Internet, linux, malicious, malware, microsoft, monitoring, network, phishing, powershell, programming, service, tactics, threat, tool, update, windowsThis is Part 2 of our two-part technical analysis on the Gopher Strike and Sheet Attack campaigns. For details on the Gopher Strike campaign, go to Part 1.IntroductionIn September 2025, Zscaler ThreatLabz uncovered three additional backdoors, SHEETCREEP, FIREPOWER, and MAILCREEP, used to power the Sheet Attack campaign. In Part 2 of this series, ThreatLabz will…
-
BIND 9 Flaw Lets Attackers Crash Servers With Malicious DNS Records
A critical vulnerability in BIND 9 exposes DNS servers to remote denial-of-service (DoS) attacks. Security firm ISC disclosed CVE-2025-13878 on January 21, 2026, warning that malformed BRID or HHIT records in DNS queries can trigger an unexpected termination of the named process. Attackers need no authentication to exploit this, making it a high-risk issue for…
-
Azure DNS Behavior Can Turn Private Endpoints Into DoS Risks
A DNS flaw in Azure Private Link can trigger DoS-like outages across linked VNETs. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/azure-dns-behavior-can-turn-private-endpoints-into-dos-risks/
-
Azure Private Endpoint Deployments Expose Cloud Resources to DoS Attacks
A critical architectural weakness in Azure’s Private Endpoint deployments could allow both accidental and intentional denial of service (DoS) attacks against cloud resources. The vulnerability stems from how Azure’s Private DNS zone resolution interacts with hybrid networking configurations, potentially affecting over 5% of Azure storage accounts and multiple critical services. The Core Vulnerability The issue…
-
NDSS 2025 Studying the Defensive Registration Practices of the Fortune 500
Session 9C: Phishing & Fraud 2 Authors, Creators & Presenters: Boladji Vinny Adjibi (Georgia Tech), Athanasios Avgetidis (Georgia Tech), Manos Antonakakis (Georgia Tech), Michael Bailey (Georgia Tech), Fabian Monrose (Georgia Tech) PAPER The Guardians of Name Street: Studying the Defensive Registration Practices of the Fortune 500 Using orthographic, phonetic, and semantic models, we study the…
-
How Security Teams Use IP Location and DNS History In Cybercrime Investigation
In many security teams, a cybercrime investigation often begins without a complete picture. It starts with a small signal. A suspicious login. An unexpected outbound connection. A single alert that does not look right. From that moment, investigators need context. Logs alone show what happened, but not who is behind it or why it matters.…
-
Researchers Hijack Hacker Domain Using Name Server Delegation
Security researchers from Infoblox have successfully intercepted millions of malicious push notification advertisements by exploiting a DNS misconfiguration technique known as >>lame nameserver delegation,<< gaining complete visibility into a large-scale affiliate advertising operation without directly compromising any systems. The researchers claimed to have identified abandoned domains used by threat actors, receiving copies of over 57…
-
New Kerberos Relay Technique Exploits DNS CNAMEs to Bypass Existing Defenses
Tags: attack, authentication, credentials, cve, cyber, defense, dns, exploit, flaw, ntlm, service, threat, vulnerability, windowsA critical vulnerability in Windows Kerberos authentication that enables attackers to conduct credential-relay attacks by exploiting DNS CNAME records. Tracked as CVE-2026-20929, this flaw allows threat actors to force victims into requesting Kerberos service tickets for attacker-controlled systems, facilitating lateral movement and privilege escalation even when NTLM authentication is entirely disabled. CVE ID Vulnerability Name…
-
Iran’s partial internet shutdown may be a windfall for cybersecurity intel
only available launchpads. A connection from the Ministry of Agriculture might not be a farmer. It’s likely a tunnel for a state actor who needs an exit node.”Ranjbar said the removal of the traffic from millions of routine Iranian business and residential users allows a powerful visibility into Iranian government traffic patterns, thereby allowing SOCs…
-
What Is a DNS Attack? Understanding the Risks and Threats
In 2026, when websites, apps, and online services drive nearly every aspect of daily life, the Domain Name System (DNS) acts as the internet’s unsung hero. It serves as the bridge between humans and machines, effortlessly translating memorable domain names like www.thecyberexpress.com, the same website you’re reading this article on. First seen on thecyberexpress.com Jump…