Global DNS Hijacking Campaign: DNS Record Manipulation at Scale | Mandiant
Tags
country: Iran
attack-pattern: Direct Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Ip Addresses - T1590.005 Multi-Factor Authentication - T1556.006 Connection Proxy - T1090
Show in Graph
Common Information
Type Value
UUID 8441c614-6472-4c26-b036-38aaf26b0777
Fingerprint a491c4f582218481
Analysis status DONE
Considered CTI value 0
Text language
Published Jan. 9, 2019, midnight
Added to db Nov. 6, 2023, 7:08 p.m.
Last updated Nov. 17, 2024, 6:30 p.m.
Headline Global DNS Hijacking Campaign: DNS Record Manipulation at Scale
Title Global DNS Hijacking Campaign: DNS Record Manipulation at Scale | Mandiant
Detected Hints/Tags/Attributes 51/2/10
Source URLs
Redirection Url
Details Source https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
Details Source https://www.mandiant.com/resources/blog/global-dns-hijacking-campaign-dns-record-manipulation-at-scale
URL Provider
Details Provider Source level domain
Details fireeye.com www.fireeye.com
Details mandiant.com www.mandiant.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 330 ✔ Threat Intelligence https://www.mandiant.com/resources/blog/rss.xml 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 22 
victim.com
Details Domain 1 
mail.victim.com
Details Domain 1 
ns1.victim.com
Details Domain 1 
ns1.baddomain.com
Details Domain 2 
www.victim.com
Details Domain 707 
google.com
Details IPv4 2 
192.168.100.100
Details IPv4 4 
10.20.30.40
Details IPv4 2 
192.168.100.200
Details IPv4 7 
10.1.2.3