2026-07-17 · DNS

DNS Hijacking: Real Cases and How to Catch It Early

DNS hijacking is when an attacker changes your DNS records — usually your nameservers or A records — to reroute your traffic through infrastructure they control, often while obtaining a valid TLS certificate so victims see no warning. It isn’t theoretical: the Sea Turtle and DNSpionage campaigns used exactly this to target dozens of governments and companies. Here’s what happened and how to catch it early.

Sea Turtle (2017–2019)

Cisco Talos documented a state-sponsored campaign it named Sea Turtle that, since January 2017, compromised at least 40 organisations across 13 countries — including ministries, intelligence and military bodies, and energy firms, mostly in the Middle East and North Africa (Cisco Talos; CyberScoop).

Rather than attack targets directly, the group went after their DNS providers, registrars and registries. Talos called it the first publicly confirmed case of a DNS registry compromise — the January 2019 breach of Sweden’s Netnod. With control of the DNS, the attackers pointed victim names at their own servers, harvested credentials, and used valid certificates so the man-in-the-middle was invisible to users.

DNSpionage (2018)

Earlier, in November 2018, Talos reported DNSpionage, which redirected the DNS of government and telecom targets in Lebanon and the UAE and obtained certificates for the spoofed domains. Talos assessed it as distinct from Sea Turtle, but the technique — hijack the DNS, then legitimise the interception with a real certificate — was the same (Cisco Talos).

The campaigns were serious enough that ICANN publicly called for full DNSSEC deployment in February 2019, citing an ongoing and significant risk to parts of the DNS infrastructure (ICANN).

How the attack works

  1. Compromise the control point — phish or breach registrar/registry/DNS-provider credentials, rather than the target’s own servers.
  2. Change records — repoint NS or A/MX records to attacker infrastructure.
  3. Get a certificate — request a domain-validated cert for the hijacked name (DV certs validate via DNS/HTTP, which the attacker now controls).
  4. Intercept — sit in the middle, capturing credentials and traffic with no browser warning.

How to catch it early

Every step above shows up as a DNS change — a new nameserver, a changed A record, an unexpected MX. The defence is to snapshot your records and alert on any diff:

Snapshot your current records now with the free domain health check.

Sources

Try it now — free, no signup. Monitor your DNS