DNS hijacking is a growing threat that can redirect users to malicious sites. However, using passive DNS monitoring can help to protect data.

Ensure DNS Traffic Security by Redirecting Through DNSMASQ on Debian

  Cybersecurity researchers have recently discovered a new malware platform known as Atroposia, which is being promoted on dark web forums as a subscription-based hacking toolkit. The platform offers cybercriminals a remote access trojan (RAT) that can secretly control computers, steal sensitive data, and even scan the infected system for security flaws, all for a monthly payment. Researchers from Varonis, a data protection firm, explained that Atroposia is the latest example of a growing trend where ready-to-use malware services make advanced hacking tools affordable and accessible, even to attackers with little technical expertise. How Atroposia Works Atroposia operates as a modular program, meaning its users can turn individual features on or off depending on what they want to achieve. Once installed on a device, it connects back to the attacker’s command-and-control (C2) server using encrypted communication, making it difficult for defenders to detect its activity. The malware can also bypass User Account Control (UAC), a security layer in Windows designed to prevent unauthorized changes, allowing it to gain full system privileges and remain active in the background. Those who purchase access, reportedly priced at around $200 per month unlock a wide set of tools. These include the ability to open a hidden remote desktop, steal files, exfiltrate data, capture copied text, harvest credentials, and even interfere with internet settings through DNS hijacking. One of the most distinctive parts of Atroposia is its HRDP Connect module, which secretly creates a secondary desktop session. Through this, attackers can explore a victim’s computer, read emails, open apps, or view documents without the user noticing anything unusual. Because the interaction happens invisibly, traditional monitoring systems often fail to recognize it as remote access. The malware also provides an Explorer-style file manager, which lets attackers browse, copy, or delete files remotely. It includes a “grabber” feature that can search for specific file types or keywords, automatically compress the selected items into password-protected ZIP archives, and transmit them directly from memory leaving little trace on the device. Theft and Manipulation Features Atroposia’s data-theft tools are extensive. Its stealer module targets saved logins from browsers, chat records, and even cryptocurrency wallets. A clipboard monitor records everything a user copies, such as passwords, private keys, or wallet addresses, storing them in an easily accessible list for the attacker. The RAT also uses DNS hijacking at the local machine level. This technique silently redirects web traffic to malicious sites controlled by the attacker, making it possible to trick victims into entering credentials on fake websites, download malware updates, or expose their data through man-in-the-middle attacks. A Built-In Vulnerability Scanner Unlike typical RATs, Atroposia comes with a local vulnerability scanner that automatically checks the system for weak spots, such as missing security patches, outdated software, or unsafe configurations. It generates a score to show which issues are easiest to exploit. Researchers have warned that this function poses a major threat to corporate networks, since it can reveal unpatched VPN clients or privilege escalation flaws that allow attackers to deepen their access or spread across connected systems. Security experts view Atroposia as part of a larger movement in the cybercrime ecosystem. Services like SpamGPT and MatrixPDF have already shown how subscription-based hacking tools lower the technical barrier for attackers. Atroposia extends that trend by bundling reconnaissance, exploitation, and data theft into one easy-to-use toolkit. How Users Can Stay Protected Analysts recommend taking preventive steps to reduce exposure to such threats. Users should: • Keep all software and operating systems updated. • Download programs only from verified and official sources. • Avoid pirated or torrent-based software. • Be cautious of unfamiliar commands or links found online. Companies are also urged to monitor for signs such as hidden desktop sessions, unusual DNS modifications, and data being sent directly from memory, as these can indicate the presence of sophisticated RATs like Atroposia. Atroposia’s discovery highlights the growing ease with which advanced hacking tools are becoming available. What once required high-level expertise can now be rented online, posing a serious challenge to both individual users and large organizations trying to protect their digital environments.

https://www.osintinvestigate.com Russian state-sponsored hackers are reportedly using artificial intelligence to automate malware development, phishing operations, DNS hijacking, credential theft, and cyber espionage. In this episode, we examine how AI-assisted cyber attacks are becoming faster, more adaptive, and harder to detect — and what this means for the future of cybersecurity.

Il s'agit d'un post-mortem technique détaillant une découverte de sécurité DNS affectant l'infrastructure téléphonique ENUM (e164.arpa) de plusieurs territoires britanniques à vocation militaire.

Il s'agit d'un post-mortem technique détaillant une découverte de sécurité DNS réalisée par un chercheur indépendant sur l'infrastructure ENUM (e164.arpa), un système de routage téléphonique via DNS issu des années 2000. Le chercheur a scanné les zones déléguées de e164.arpa à la recherche de zones abandonnées.

This bulletin covers a wide range of threats, from phishing and fake install guides to credential stuffing, DNS hijacking, and AI-assisted exploitation, all aimed at stealing access, data, or money. It also highlights major campaigns and incidents involving XWorm, GenieLocker, MacSync Stealer, CastleLoader, SpyGlace, MedusaHVNC, ShinyHunters, and Origin Energy, along with...

https://www.osintinvestigate.com Cybercriminals are targeting hotel Wi-Fi gateways to steal Microsoft 365 credentials by redirecting users to fake login pages. Learn how this attack works, why public Wi-Fi poses new risks for business travelers, and the security measures organizations and individuals can take to stay protected.

included every cubepilot.org subdomain read more about CubePilot drone software dev hit by DNS hijacking to intercept traffic

Hazy Hawk gang uses DNS hijacking for large-scale scams. #Cybersecurity #DNShijacking #ThreatActor

The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks. EdgeStepper "redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure

The APT28 DNS hijacking operation exploits SOHO router vulnerabilities, fueling a global espionage campaign and elevating cybersecurity risks.

Microsoft Threat Intelligence details a large-scale campaign by the Russian-aligned actor Forest Blizzard and its sub-group Storm-2754 that exploited vulnerable SOHO routers to hijack DNS requests and collect network traffic, enabling passive reconnaissance and selective adversary-in-the-middle (AiTM) attacks against TLS connections. The activity impacted over 200 organizations and 5,000 consumer devices across sectors like government, IT, telecommunications, and energy, and Microsoft provides mitigation, detection, and hunting guidance to reduce exposure and investigate related activity #ForestBlizzard #Storm-2754

DNS hijacking is a growing threat that can redirect users to malicious sites. However, using passive DNS monitoring can help to protect data.

A cybercriminal group named 'Hazy Hawk' is exploiting DNS misconfigurations to hijack abandoned cloud endpoints of domains belonging to trusted organizations. This technique, known as DNS CNAME hijacking, allows the group to integrate these domains into traffic distribution systems (TDS) and deliver large-scale scams. The impacts include compromising the security of trusted domains and using these domains for malicious activities.