DNS, the Internet's phonebook

A domain name has value only through the records associated with it. CISA cites, for example, address records (A), mail server records (MX) and name server records (NS)².

The attack path described by CISA has three steps. The attacker compromises, or otherwise obtains, the credentials of an account that can modify DNS records. They then replace a service's legitimate address with an address they control, which lets them examine or manipulate the traffic before, if they choose, passing it on to the real service. Finally, they can obtain valid certificates to decrypt this traffic and read the data users enter². CISA adds that this risk persists beyond the redirection period².

MITRE points to another possibility: silently creating subdomains that point to malicious servers, without the owner of the DNS server noticing³. The same text states that much of this activity takes place out of view of the targeted organization, which makes detection difficult³.

DNS also serves as a command channel. In the DNS beaconing technique, commands pass through DNS requests, in TXT or A type records. These beacons are hard to spot because they rarely communicate with the infected devices, which drowns them in normal traffic⁴. Dynamic resolution, for its part, lets malware adjust the domain name, IP address or port it uses⁵.

• Read the displayed address before entering a password or data. Compare it letter by letter with the usual address: a similar domain name with a typo leads to a different site.
• Do not rely on the absence of a browser alert. A valid certificate does not prove that no redirection took place².
• Open your services through your bookmarks or through the official address the company provides rather than through a link you received.
• Report any unusual behavior to your support: an unexpected login page, a mail service that behaves differently, a known site that looks different.
• Do not change the DNS settings of your device or of your office router.

First pitfall: believing that a correct address is enough. In the attacks described by CISA, it is the phonebook that is altered, not the address the user types².

Second pitfall: thinking that the subject concerns only IT staff. The attack starts with credentials: CISA required US federal executive branch agencies to change the passwords of accounts able to modify DNS and to add multifactor authentication². It recommends phishing-resistant factors and advises against SMS authentication². An employee who manages a domain name or an account with a DNS host is directly concerned.

Third pitfall: assuming the provider is always safe. MITRE lists the compromise of third-party DNS servers among attacker techniques, which spares them from setting up their own servers³.

Dynamic DNS services, such as DuckDNS, were used by the APT-C-36 group to redirect victims to sites or repositories hosting malware⁵. An unknown domain name is therefore no sign of trust, whatever its appearance.

January 2019: CISA's emergency directive

On January 22, 2019, CISA published emergency directive ED 19-01, "Mitigate DNS Infrastructure Tampering"². It stated that it was tracking a series of DNS infrastructure tampering incidents and was aware that several US executive branch agency domains were affected². It required four actions from agencies. The first three, to be completed within 10 business days, were to audit public DNS records, change the passwords of the accounts concerned and add multifactor authentication². For the fourth, CISA began, within 10 business days, to deliver the new certificates to certificate transparency logs, and agencies had to monitor them upon receipt². CISA's text now states that it concluded the directive's objective was met and that it closed the directive².

2019: the Sea Turtle campaign

MITRE links to the Sea Turtle group the modification of name server (NS) records to point to DNS servers it controlled, in order to provide the answers to all DNS requests³. Among MITRE's references is a Cisco Talos analysis dated April 17, 2019, "Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service", followed by a second one dated July 9, 2019³. The sources in the file do not detail the victims of this campaign.

The NIST SP 800-81 Rev. 3 guide, published in March 2026, replaces the 2013 version¹. It gives deployment recommendations to secure the DNS protocol and infrastructure, limit configuration errors and add a layer of network security¹. Among its keywords are DNSSEC, encrypted DNS, protective DNS and DNS logging¹. The CISA directive also points to monitoring issued certificates and keeping an inventory of managed domains².