GDT Webinar Series – How to Fail at Security? Reserve Your Spot

Last week’s DHS “alert” upgraded to "an emergency directive”

Warning cyber attack

Last week, the US Department of Homeland Security (DHS) issued an alert through its US-CERT (Computer Emergency Readiness Team) division concerning repeated DNS hijacking attacks. Apparently, the alert was well deserved. Yesterday, it was significantly upgraded to an emergency directive due to a spate of recent DNS hijacking incidents that have originated in Iran.

Last week’s alert was due to a recent report published by FireEye, a California-based cybersecurity firm. In it, they provided details concerning a coordinated hacking campaign led by an Iranian cyber-espionage group that had manipulated DNS records for both government agencies and private enterprises.

The hijackers’ end game? Redirect traffic meant for email servers to malicious clones, after which they’ll scan for and gather treasured login credentials.

The Directive

The DHS emergency directive orders all government agencies to carefully audit its DNS records and look for unauthorized changes, especially any related to passwords. And it directs them to enable multi-factor authentication for those accounts that can be managed through DNS records.

In addition, they urge all IT personnel to monitor Certificate Transparency (CT) for recently-issued TLS certificates used for government domains. Also, to pay special attention to any requested by non-government employees.

How does DNS Hijacking work?

In the simplest of definitions, DNS hijacking is simply a means of redirecting traffic to a phony website. As a quick refresher, DNS was invented to translate complex, impossible-to-memorize IP addresses into something that’s far easier to remember (like, for instance,—much easier to commit to memory than nine (9) numbers listed in no intuitive, commonsensical order).

When you type in a website’s name, the DNS is called on to direct traffic to its corresponding IP address. Usually your ISP maintains the DNS servers, and if a hacker can crack into them, let the hijacking hijinks begin. From there, they can change victims’ DNS records to point traffic toward their servers. Then their party starts. They capture as much login information as they can stomach.

Who has been affected by the attack?

Currently, the DHS, according to a report published by Cyberscoop, a multimedia provider of cybersecurity-related news and information, is aware of six (6) civilian organizations that have fallen victim to this particular DNS hijacking attack. What the DNS doesn’t know yet is how many government agencies have been affected. In its directive, they outlined a four-step action plan to address the issue. All government agencies have been given ten (10) business days to complete it.

Security Concerns?

To find out how to secure your organization’s network and mission critical data, contact GDT’s tenured and talented engineers and security analysts at From their Security and Network Operations Centers, they manage, monitor and protect the networks of companies of all sizes, including those for some of the most notable enterprises, service providers, healthcare organizations and government agencies in the world. They’d love to hear from you.


Share this article

You might also like:

Mergers, acquisitions, and divestitures (M&A/D) offer opportunities for businesses to grow, streamline operations, and enter new markets. However, strategic planning and financial negotiations can overshadow a crucial element: information security.   This blog post dives into the critical security considerations for M&A/D activities, exploring the importance of information security, potential risks,

AI and Data Security

The advent of artificial intelligence (AI) brings transformative potential across industries while also introducing significant data security challenges. As AI systems become integral to operational and decision-making processes, safeguarding sensitive information against sophisticated threats is paramount. This exploration sheds light on the complexities of AI and data security and proposes

Transport layer security (TLS)

Transport layer security (TLS) is one of the most common tools for keeping users safe on the internet. When automated, TLS certification management can help organizations ensure more reliable and consistent use of TLS, reducing the need for human intervention and risk of human error. In fact, over the years,