Widespread DNS Hijacking Campaign with Possible Iranian Nexus Targets Multiple Sectors

A threat actor — with a possible but unconfirmed Iranian nexus — conducted a two-year DNS hijacking campaign targeting 28 organizations across 12 countries. By modifying victims' DNS records, the attackers silently redirected internet traffic destined for legitimate government, ISP, and aviation domains to their own infrastructure, where they could intercept data and credentials. CrowdStrike published its analysis on January 25, 2019, identifying 18 malicious IP addresses and 5 actor-controlled name server domains used across the campaign.

Attribution remains inconclusive. CrowdStrike noted that the heavy targeting of Middle Eastern government entities aligns with Iran's traditional intelligence collection interests, and public reporting at the time pointed to a possible Iranian nexus. However, the extended timeframe of the campaign and variance in infrastructure led CrowdStrike to note it was unclear whether one or multiple actors were involved. FireEye's concurrent reporting also suggested possible Iranian connections but stopped short of definitive attribution.

The likely objectives were direct interception of web traffic, credential theft from captured traffic, and potential malware delivery against victims routed to malicious infrastructure. Government domain hijackings suggest intelligence collection was the primary mission — capturing login credentials, email communications, and web traffic from employees of targeted ministries and agencies. The targeting of ISPs and core internet infrastructure operators also raised concern about potential downstream collection against a much wider set of unidentified organizations using those services.

The campaign hit 28 organizations in 12 countries across a two-year period. The primary focus was the Middle East and North Africa — Jordan, Kuwait, UAE, Iraq, Egypt, Libya, Lebanon, Saudi Arabia, and Albania were all affected, predominantly in the government sector. Sweden and the United States were also impacted, specifically in internet infrastructure. The broad geographic and sectoral reach, combined with targeting of ISPs and root internet infrastructure, suggests the actors were casting a wide net to support intelligence collection across the region.

Government entities across the Middle East were the dominant targets — consistent with intelligence collection interests focused on regional geopolitics, foreign policy communications, and government operations. ISPs and internet infrastructure operators were particularly significant targets because compromising them could enable passive surveillance of a far wider range of organizations using their services, without needing to target each downstream customer individually. Civil aviation, insurance, and law enforcement entities were also hit, broadening the intelligence value of the intercepted traffic.

The attackers modified the DNS records of victim organizations — either by compromising the domain registrar accounts or the authoritative DNS servers themselves — so that the domains resolved to attacker-controlled IP addresses instead of the legitimate servers. Users visiting those domains were silently redirected without any visible warning. To make the interception completely transparent, the attackers obtained fraudulent TLS certificates for the hijacked domains through Let's Encrypt, a free certificate authority. This meant browsers showed a valid padlock icon, and users had no indication they were connected to malicious infrastructure. The hijacking windows were typically very short — often under 24 hours — suggesting rapid credential harvesting operations.

The use of fraudulent TLS certificates obtained through Let's Encrypt is the most technically significant aspect of this campaign. By presenting a valid certificate for the hijacked domain, the attackers ensured that victim browsers showed a secure padlock icon and did not generate any certificate warnings. This completely neutralized one of the main security indicators users rely on to detect impersonation attacks. It exploited a legitimate feature of the internet's certificate infrastructure — domain-validated certificates require only proof of DNS control, which the attackers had already obtained through hijacking.