Forest Global Training Partners

Cyber Risks · Cisco Talos

DNSpionage Campaign Targets Middle East

Summary: Cisco Talos discovered a campaign it named DNSpionage targeting Lebanon and the UAE, using two fake job-posting websites and malicious Microsoft Office documents with password-protected macros to deliver a remote administration tool that communicates over HTTP and DNS. In a separate but linked campaign, the same actor redirected DNS for .gov and private domains, including Lebanon's Finance Ministry email domain, UAE law enforcement and Telecommunication Regulatory Authority domains, and Middle East Airlines, generating Let's Encrypt certificates for each redirected domain.

What you should know: The actor redirected DNS for government domains in two countries and a national airline over two months, and because email and VPN traffic were specifically targeted, intercepted credentials and MFA codes could have been harvested - Talos does not know whether the redirections succeeded, and reports the actor has launched five attacks this year.

Read the original at Cisco Talos ↗

Topics
Malware
Related