We uncovered Underminr, a vulnerability that exploits shared hosting ecosystems with a novel technique and lets attackers circumvent common network security practices. Around 88 million domains are affected worldwide. The vulnerability is under active exploit, and AI-orchestrated malware campaigns could scale it to overwhelm defenses worldwide.
What Underminr is
Underminr is a vulnerability in the implementation of internet-bound connections involving large-scale hosting providers. Attackers exploit it to circumvent security and evade detection when they connect to C2 or exfiltrate data.
It resembles legacy domain fronting, which Content Delivery Networks (CDNs) essentially neutralized in 2018. Underminr uses new Tactics, Techniques, & Protocols (TTPs), so it is mostly invisible to defenders and hosting providers that already neutralized legacy domain fronting. In an attack chain, it lets Advanced Persistent Threats (APTs) and other malicious actors abuse trusted domains with impunity.
“Once Underminr becomes parametric information for AI-generated malware, we could expect to see it in every attack that needs to evade protective DNS as part of the attack chain”, said David Redekop, CEO of ADAMnetworks. “Because it fundamentally undermines the critical infrastructure that makes up the backbone of the internet, we felt we had to collaborate with technology providers and defenders across the industry before this potential wave hits.”
Disclosure and tools for defenders
As part of responsible disclosure, we worked with multiple industry partners to share intelligence and build an open source application that lets cyber defenders detect Underminr evasion attempts from inside their networks. We are also publishing an official impact report, which we will update periodically as collaborators monitor the vulnerability, and a website where domain owners can check in real time whether their domains are vulnerable to Underminr abuse: underminr.ai.
Scope of impact
We tested the top 5 million domains against the vulnerability. The full report shows the scope of impact and which content delivery networks are most vulnerable.
The internet infrastructure of the USA, Canada and the UK is highly vulnerable to Underminr attacks, with a disparity of risk greater than 2:1 against Russia and over 6:1 against China, which remains mostly immune. The regional view on underminr.ai maps the vulnerable share by country.
Industry response
Chester Wisniewski, an industry veteran and Global Field CISO at Sophos, said: “Millions of users globally rely on DNS filtering technology to provide a transparent layer of protection to their online activities, especially when outside of a secured business network. Underminr allows malicious actors to abuse their infrastructure to disguise their nefarious activities.”
Tom Newton, VP at Qoria, said Underminr forces defenders to adapt their technologies: “The internet depends upon the integrity of connections requested by devices and authorised by security systems. Until cloud operators address this vulnerability as they did with domain fronting in the past, we must continue to evolve our defensive capabilities.”
Our mitigation
Our pre-emptive security solution uses a new Zero Trust resolver, designed to neutralize yet-unknown and undetectable threats by applying an AI-enhanced default-deny-all posture to all outbound connections. It is device agnostic, so it also protects IoT and OT assets in sectors such as Manufacturing, Defense, Healthcare and Critical Infrastructure. The latest release neutralizes Underminr attacks for defenders who need to secure mission-critical assets.
