Cyber Defense eMagazine February Edition for 2023

In response to North Korean state-sponsored (Lazarus) crypto attacks also in April, the FBI, CISA and
the U.S. Treasury Department issued a joint alert advising organizations to have a robust domain security
solution in place that includes leveraging reputation checks and closely monitoring or blocking newly
registered domains (NRDs) in enterprise traffic.
More recently, the FBI issued an alert in May about Business Email Compromise (BEC), stressing the
importance of strong DNS layer security to combat phishing attacks. All of this follows previous
government agency directives urging organizations to take actions to bolster DNS security.
DNS is the Internet protocol that translates host names, like www.amazon.com, into IP addresses. It's
the phone book of cyberspace, and an organization’s weakest network link. Security officials’ increased
focus on DNS layer protection comes as no surprise today, as more than 78% of breaches involve the
DNS layer.
DNS Threats on the Rise: Targeted Phishing and Malware Tactics
The DNS layer is ripe for exploitation from a hacker’s perspective. Attackers will set up their trap,
commonly in the form of malware, ransomware, and phishing scams. Then they rely on DNS servers to
connect unwitting victims to malicious content.
We have seen significant increases across threat types in 2022 from our global network processing more
than 1 trillion queries a month. It paints a picture of targeted phishing and malware tactics.
• 200% increase in malware traffic
• 300% increase in phishing traffic
• 1200% increase in botnet traffic
• Deceptive sites that leverage the term “gov” have increased nearly 5x. The start of the “gov”
domain traffic spike aligned with the start of the Russian invasion of Ukraine
• Phishing traffic to German sites (.de) increased 125% at the end of March. Germany continues to
have one of the most-used country code top-level domains (ccTLDs) for malicious domains
• At the end of April, malicious websites with “health” in the name rose 218%
• A 318% spike in malicious traffic using “bank” in the domain name. Threat actors eying banks, or
bank patrons, isn’t a surprise as the banking industry saw a 1318% increase in ransomware
attacks in 2021.
In addition to malware, phishing, ransomware, and other cyber attacks, common DNS-related threats
include cryptocurrency and associated threats such as the North Korean crypto attacks. When
cryptocurrency made a comeback in 2020, security was impacted in a major way because threat actors
saw a new opportunity for compromise. Ransomware payments are made with cryptocurrency, because
they are on the blockchain anonymously and can’t be traced.
Among the common DNS-based cryptocurrency-related threats are typosquatting domains, phishing
domains, cryptojacking, mining pools and DNS poisoning. According to DNSFilter’s 2021 threat
Cyber Defense eMagazine – February 2023 Edition 140
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.