Share this
An update on the Kaseya ransomware attack CNC domains
by Peter Lowe on Jul 9, 2021 12:00:00 AM
Command and Control Domains
The attack by REvil used several domains, called "Command and Control" domains (also referred to as "C2 domains" or "CNC domains"), which are used after a system has been attacked. The purpose in this case is to notify REvil that the systems had been encrypted.
The configuration file of the ransomware was published by Fabian Wosar on GitHub. From that file, we extracted the list of domains. These domains are not all actually compromised systems—it's likely that only a few are, and the rest are either decoys or have been cleaned up.
Out of an abundance of caution, DNSFilter has marked all of these domains as malicious. We did so on July 3rd, when the domains were first made available. We are doing our best to verify entries and investigate specific aspects of the CNC servers, in order to eliminate false positives from the list.
This was published on GitHub as a service to others—it's an unsorted list in the config file, so making this more easily available could help others who are investigating.
Important notes
The domains shouldn't be taken as a list of compromised systems. It is simply an extract from the config file of domains marked there as "command and control".
If there are any entries that can be verified as clean, please contact us or submit a pull request on the GitHub repository.
Further information
For more information on REvil and the Kaseya ransomware attack, please check out these thorough overviews:
Share this

Our analysis of Tycoon 2FA infrastructure has revealed significant operational changes, including the platform's coordinated expansion surge in Spanish (.es) domains starting April 7, 2025, and evidence suggesting highly targeted subdomain usage patterns. This blog shares our findings from analyzing 11,343 unique FQDNs (fully qualified domain names) and provides 65 root domain indicators of compromise (IOCs) to help network defenders implement mo...

Staying Ahead with Smarter Web Filtering
Across every industry and network environment, content filtering isn’t just a matter of productivity, it’s a front line of defense. From malware and phishing to compliance risks and productivity drains, the threats are real, and the stakes are high.

DNS filtering is a foundational layer of defense and helps to fortify the strongest security stacks. Most organizations use DNSFilter to block the obvious: malware, phishing, and adult content. That’s a great start, but many are missing out on the broader potential of DNS policies.