Sitting Ducks DNS Attack Hijack 35,000 Domains

Cybersecurity researchers have uncovered a significant threat affecting the internet’s Domain Name System (DNS) infrastructure, known as the “Sitting Ducks” attack. This sophisticated method allows cybercriminals to hijack domains without needing access to the owner’s account at the DNS provider or registrar. 

Researchers from DNS security firm Infoblox and hardware protection company Eclypsium revealed that more than one million domains are vulnerable to this attack daily. This has resulted in over 35,000 confirmed domain hijackings, primarily due to poor domain verification practices by DNS providers.

The Sitting Ducks attack exploits misconfigurations at the registrar level and insufficient ownership verification. Attackers leverage these vulnerabilities to take control of domains through “lame” delegations, making the hijacking process more effective and harder to detect. 

Once in control, these hijacked domains are used for malware distribution, phishing, brand impersonation, and data theft.

Russian threat actors have been particularly active, with twelve known cyber-gangs using this method since 2018 to seize at least 35,000 domains. These attackers often view weak DNS providers as “domain lending libraries,” rotating control of compromised domains every 30-60 days to avoid detection. 

The Sitting Ducks attack has been exploited by several cybercriminal groups. “Spammy Bear” hija

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.