Share this
An update on the Kaseya ransomware attack CNC domains
by Peter Lowe on Jul 9, 2021 12:00:00 AM
Command and Control Domains
The attack by REvil used several domains, called "Command and Control" domains (also referred to as "C2 domains" or "CNC domains"), which are used after a system has been attacked. The purpose in this case is to notify REvil that the systems had been encrypted.
The configuration file of the ransomware was published by Fabian Wosar on GitHub. From that file, we extracted the list of domains. These domains are not all actually compromised systems—it's likely that only a few are, and the rest are either decoys or have been cleaned up.
Out of an abundance of caution, DNSFilter has marked all of these domains as malicious. We did so on July 3rd, when the domains were first made available. We are doing our best to verify entries and investigate specific aspects of the CNC servers, in order to eliminate false positives from the list.
This was published on GitHub as a service to others—it's an unsorted list in the config file, so making this more easily available could help others who are investigating.
Important notes
The domains shouldn't be taken as a list of compromised systems. It is simply an extract from the config file of domains marked there as "command and control".
If there are any entries that can be verified as clean, please contact us or submit a pull request on the GitHub repository.
Further information
For more information on REvil and the Kaseya ransomware attack, please check out these thorough overviews:
Share this
Categories
- Featured (258)
- Protective DNS (15)
- IT (12)
- Cybersecurity Brief (7)
- AI (6)
- Deep Dive (6)
- IndyCar (6)
- Content Filtering (5)
- Public Wi-Fi (5)
- IT Challenges (4)
- Roaming Client (4)
- Team (4)
- Compare (3)
- Malware (3)
- Tech (3)
- Anycast (2)
- Events (2)
- Machine Learning (2)
- Phishing (2)
- Ransomware (2)
- Tech Stack (2)
- Secure Web Gateway (1)
![Revving Up the Fun: DNSFilter's IndyCar Experience Recap — Toronto Edition Revving Up the Fun: DNSFilter's IndyCar Experience Recap — Toronto Edition](https://www.dnsfilter.com/hubfs/revvingupthefundnsfiltersindycarexperiencerecaptorontoedition1.webp)
First raced in 1918, the Toronto Grand Prix is an exciting and long-standing IndyCar tradition. With 11 turns winding through downtown Toronto, including a particularly tight final curve, this street course always lends to a competitive and unpredictable race.
![Lookalike Crowdstrike Domains Discovered by DNSFilter to Date Lookalike Crowdstrike Domains Discovered by DNSFilter to Date](https://www.dnsfilter.com/hubfs/newsroom_lookalikecrowdstrikedomainsdiscoveredbydnsfiltertodate1.webp)
As most of the world is aware, after a routine update pushed by CrowdStrike last week to Microsoft devices, a global IT outage occurred impacting a range of industries including hospitals, broadcast television, government, and most notoriously airlines.
![Traversing the World of AI with Judy Security Traversing the World of AI with Judy Security](https://www.dnsfilter.com/hubfs/blog_traversingtheworldofaiwithjudysecurity%281%291-1.webp)
Raffaele Mautone, CEO of Judy Security, recently joined us for an interview session around the increasing presence of AI in cybersecurity. This insightful Q&A session sheds light on how AI is integrated into Judy Security's operations. Raffaele also touches on the broader implications of AI for the future, making a compelling case for its strategic use in both day-to-day operations and long-term security strategies.