Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime

Summary: Unit 42 describes domain shadowing, a DNS hijacking variant in which attackers quietly create malicious subdomains under compromised domains while leaving existing records intact so normal services keep running. Its machine learning pipeline, processing terabytes of passive DNS logs daily, detected 12,197 shadowed domains between April 25 and June 27, 2022, of which only 200 were flagged as malicious by any VirusTotal vendor.

Why it matters: VirusTotal vendors marked less than 2% of the 12,197 shadowed domains as malicious, and in the 649-subdomain phishing campaign under 16 compromised domains, fewer than one quarter were flagged - so reputation-based defenses will pass most of these domains through.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related