New Underminer Exploit Allows Hackers to Conceal Malware Behind Trusted Domain Names
Threat Actors Utilize Underminr Vulnerability
Security researchers have identified a novel method employed by threat actors to conceal their malicious activities behind trusted domains.
The Underminr Technique
- Exploits vulnerabilities in shared content delivery network (CDN) infrastructure
- Masks connections to command-and-control (C&C) servers, virtual private networks (VPNs), and proxy connections
- Manipulates Server Name Indication (SNI) and HTTP Host headers
- Bypasses network egress policies and maintains a low profile
According to experts, “Underminr operates by presenting the SNI and HTTP Host of a legitimate domain while forcing a request to the IP address of another tenant on the same shared edge.”
Vulnerability Impact
- Observed in attacks targeting large-scale hosting providers
- Easily exploitable using malicious applications and shell scripts
- Roughly 88 million domains potentially vulnerable to Underminr
- Mainly affects the United States, the United Kingdom, and Canada
Future Implications
- Increasing reliance on artificial intelligence (AI) by threat actors
- Use of Underminr and similar techniques likely to increase
- Importance of proactive security measures and continuous threat intelligence gathering
About Author
English