TechKnowSurge

VideoSecurityFree

Domain Shadowing

Domain shadowing is an attack technique where threat actors compromise a legitimate domain's DNS server and secretly insert malicious records to redirect traffic for phishing, malware distribution, data exfiltration, or command-and-control operations. By piggybacking on a trusted domain, attackers make malicious activity appear credible and avoid detection.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Domain shadowing is a cyberattack technique that exploits a legitimate domain's DNS infrastructure to conceal and facilitate malicious activity. Instead of directing targets to an obviously suspicious domain, an attacker who has compromised a DNS server secretly inserts rogue records that route traffic to attacker-controlled resources while the legitimate domain continues to function normally. The unauthorized records blend into the server's existing configuration, making detection difficult without active monitoring tools specifically designed to flag unexpected DNS changes. This technique serves as a force multiplier for a variety of downstream attacks. Threat actors leverage shadowed domains to send phishing emails that appear to originate from trusted sources, host malware payloads, exfiltrate stolen data, or maintain command-and-control channels over compromised systems. The trusted reputation of the host domain lowers end-user suspicion and can also help malicious traffic evade security filters that rely on domain reputation scoring. Understanding how domain shadowing works is foundational to building detection strategies and DNS hardening practices that can identify unauthorized record modifications before they are weaponized.

What you'll learn

Explain how domain shadowing exploits compromised DNS infrastructure to conduct malicious activity while evading detection

What's covered

Domain Shadowing

Core Concept
- Uses legitimate domain
- Avoids suspicious URLs
- Operates stealthily
How It Works
- Compromise DNS server
- Inject hidden DNS records
- Records point to attacker resources
Malicious Use Cases
- Phishing emails
- Malware distribution
- Data exfiltration
- Command and control
Why It Succeeds
- Blends into existing records
- Changes go unnoticed

Key terms

Domain Name System: A hierarchical naming system that translates human-readable domain names into IP addresses.
Phishing: A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Domain Shadowing: An attack technique in which a threat actor compromises a legitimate domain's DNS infrastructure to create stealthy subdomains or records that redirect traffic to malicious resources while evading detection.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.

Topics

Domain Shadowing Dns Hijacking Dns Security Threat Evasion Command And Control Cybersecurity Phishing

Transcript

Using a legitimate domain

Another way that we could trick end users is through something called domain shadowing. It's a way that we can get away with a little bit more using a legitimate domain.

Let's develop a little scenario here. Let's say we have this machine right here that has a user on it, and we're trying to trick them to go to a site, and our site that we chose was malware.com. Now, this is obviously problematic, because why would they click on a link going to there? Why would they ever go to something called malware rs.com? We need to figure out some sort of domain that looks a little more legitimate, or if we could find a legitimate domain and actually have some control over it, then that would actually be an ideal situation. That's what domain shadowing is.

Sneaking records into someone else's DNS

Let's say we happen to compromise one of Microsoft's servers. In fact, it's their DNS server, so we're in charge of their DNS server. What we're going to do, rather than do something really bad with the server and bring it down and cause all sorts of problems to Microsoft, but only for a very short period of time because they will get it back up and running quickly and figure out their security hole and then patch it, is we could really leverage this domain to our advantage.

We could create some records on their DNS server that point to our resources, and then when we're pointing to those resources, it looks much more legitimate, and we do it stealthily. We do it in the shadow. We do it in a way that they don't see that we've made some sort of alteration, so it looks very normal.

You can imagine Microsoft's DNS servers have a ton of records, so to go in there and sneak one in there might go unnoticed. Not with Microsoft, because they've got lots of software and stuff that monitors for that thing. But that's what we're learning to do, right, the defense side of this? That's why we're learning the offense side.

But anyway, this is the scenario of domain shadowing, where we sneak a record into there and use somebody else's domain for our purposes. We could be using this to send out phishing emails, or maybe they have links to some sort of malware distributions, or perhaps it's to carry out some sort of data exfiltration or command and control.

The attack card

Here's the attack card on domain shadowing. That's when we're using some sort of legitimate DNS server, but we are using it for illegitimate purposes. We're sneaking some sort of records in there to go undetected, and we're using it for one of many different things, to carry out whatever kind of malicious activity that we want to carry out.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →