When we move fast towards digital without having knowledge, it could make things fatal. Like the recent, malicious campaing, GhostDNS that has led to some serious attacks. It is not clear at the moment how many people have been exposed to the attack and for how long the campaign has been running, but Proofpoint said the attackers behind the campaign have previously been responsible for infecting more than 1 million people a day.
Chinese cybersecurity researchers have uncovered a widespread, ongoing malware campaign that has already hijacked over 100,000 home routers and modified their DNS settings to hack users with malicious web pages, especially if they visit banking sites and steal their log-in credentials.
Security experts from Qihoo 360 NetLab spotted GhostDNS, a malware that has already infected over 100K+ devices and targeted 70+ different types of routers. According to a new report from cybersecurity firm Qihoo 360's NetLab, just like the regular DNSChanger campaign, GhostDNS scans for the IP addresses for routers that use weak or no password at all, accesses the routers' settings, and then change the router's default DNS address to the one controlled by the attackers.
Attackers have already hijacked over 100,000 home routers between September 21 and 27. The GhostDNS campaign has compromised more than 100,000 routers, most of them (87.8%) located in Brazil and has the ability to change DNS settings on the infected device. GhostDNS scans for the IP addresses used by routers that use weak or no password then accesses them and changes the DNS settings to a rogue DNS server operated by the attackers. Attackers appear to mainly target the major banks.
“Currently the campaign mainly focuses on Brazil; we have counted 100k+ infected router IP addresses (87.8% located in Brazil), and 70+ router/firmware have been involved, and 50+ domain names such as some big banks in Brazil, like Citibank, even Netflix,” states the researchers.
