LIGHTNING TALK - Tracking a Bear’s DNS tracks in a Forrest… During a Blizzard
Danny Adamitis, Lumen Technologies
Black Lotus Labs, the threat research team at Lumen Technologies, has been tracking a campaign associated with the threat actor group “Forest Blizzard”. During this investigation one most notable technique from this network, dubbed Frost Armada, modified DNS settings on compromised routers to hijack local network traffic to capture and exfiltrate authentication credentials. When targeted domains were requested by a user, the actor redirected traffic to an Attacker-in-the-Middle (AitM) node, where those credentials were harvested and exfiltrated. This approach enabled a nearly invisible attack that required no interaction from the end user for surreptitious data collection.