A new hacking campaign, dubbed “Sea Turtle,” has been discovered recently, targeting public and private organizations. The hallmark of this campaign is that hackers are carrying out DNS hijacking attacks.
The data available so far shows attacks on approximately 40 organizations in 13 countries.
Attackers are very well organized and use sophisticated methods, which give them access to sensitive networks and systems.
DNS hijacking attacks redirect users to malicious websitesby modifying DNS name records or server settings.
The campaign appears to target two categories of victims. The first category includes national security organizations, foreign ministries, and energy-related organizations. The second category of victims includes DNS administrators, telecommunications companies, and internet service providers.
The first target of attackers is third-party companiesthat offer services to the primary targets.
The investigation showed that this is one of the most serious and sophisticated campaigns of this kind.
DNS Hijacking Attack
Attackers obtain the credentials of the organization's network administrator and modify the DNS records.
Otherwise, they gain access through a DNS registrar, who sells domain names and manages DNS records. The DNS registry is accessible through the registry application using the Extensible Provisioning Protocol (EPP).
Hackers obtain one of these EPP keys to modify the DNS records, which are handled by the administrator.
Hackers try to steal credentials to gain access to networks and systems in the following way: first they try to control the target's DNS records, then they modify the DNS records to redirect users to servers under the hackers' control, and finally they steal credentials when users communicate with the controlled server.
Through these processes, hackers managed to gain access to organizations' systems and carry out attacks.
