Threat Actors Leveraging Dynamic DNS Providers to Use for Malicious Purposes
Cybersecurity research indicates an increasing trend where threat actors are exploiting Dynamic DNS providers to establish command and control infrastructures. These services, originally intended for legitimate hosting, have become platforms for…
Cybersecurity research indicates an increasing trend where threat actors are exploiting Dynamic DNS providers to establish command and control infrastructures. These services, originally intended for legitimate hosting, have become platforms for circumventing traditional security measures and oversight.
The primary attraction of Dynamic DNS providers lies in their minimal registration requirements and lack of stringent enforcement mechanisms. Unlike conventional domain registrars, these providers operate with less oversight, allowing malicious actors to establish hosting infrastructure with minimal identity verification.
Recent analyses have identified the exploitation of approximately 70,000 domains offering subdomain rental services. Attackers use these platforms to register subdomains and host malicious content, leveraging the perceived legitimacy of established parent domains. The DNS records are typically managed automatically, providing an additional layer of security for attackers by masking their involvement.
Research has highlighted the use of Dynamic DNS domains by high-profile threat groups such as APT28 and state-sponsored groups like APT29. These groups employ Dynamic DNS domains for command and control communications, demonstrating the strategic value of these services. Chinese APT groups, including APT10 and APT33, have also integrated Dynamic DNS infrastructure into their operations.
These services, originally intended for legitimate hosting, have become platforms for circumventing traditional security measures and oversight.
Command and Control Infrastructure Abuse
The use of Dynamic DNS providers in command and control communications is a significant concern. These services allow persistent communication with compromised systems while providing operational flexibility and resilience against takedown efforts. The distributed nature of these services creates a complex infrastructure that traditional security controls find challenging to monitor and block.
The technical architecture involves multiple layers of obfuscation and redundancy. Attackers often register multiple subdomains across various providers, using domain generation algorithms to switch between active nodes. This ensures continuity even when individual domains are identified and blocked. Automatic DNS record management further reduces the operational footprint of attackers.
Analysis of malicious campaigns reveals sophisticated rotation techniques, where attackers pre-register numerous subdomains and implement time-based activation schedules. This approach allows for long-term persistence while minimizing exposure. The low cost and minimal verification requirements of these services enable the establishment of extensive backup infrastructure, posing significant challenges for mitigation efforts.
Based on reporting by Cyber Security News.