{ "family": "dnschanger", "sample_count": 11, "category": "trojan", "description": "DNSChanger is one of the largest and most commercially damaging malware operations in internet history, first detected in 2007. Operated by Estonian cybercriminal Vladimir Tsastsin and his front company 'Rove Digital' in Tartu, Estonia, DNSChanger covertly modified Domain Name System (DNS) server configuration settings on infected computers and local home routers, redirecting all outbound internet web traffic through an illicit network of rogue DNS servers hosted in New York and Chicago.\n\nBy hijacking DNS resolution, the operators silently intercepted web traffic from over 4 million compromised computers in more than 100 countries—including over 500,000 systems in the United States, penetrating internal networks at NASA and the Department of Defense. When victims visited popular websites (such as Amazon, Netflix, or search engines), the rogue DNS servers redirected them to spoofed advertising networks, generating over $14 million in fraudulent ad revenue. In November 2011, the FBI and Estonian Police executed 'Operation Ghost Click', arresting Tsastsin and five accomplices in Estonia. Because abruptly terminating the rogue DNS servers would have severed internet access for millions of users worldwide, the US federal court authorized the Internet Systems Consortium (ISC) to operate clean surrogate DNS servers for eight months until July 2012 while global remediation took place. Tsastsin was extradited to the US, pleaded guilty in SDNY federal court, and was sentenced to federal prison in 2016.", "cta": "Published by the SystemHelpdesk team.", "aliases": [ "DNSChanger", "Trojan.DNSChanger", "Win32/DNSChanger", "OSX.DNSChanger", "Rove Digital" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What was the DNSChanger malware?", "acceptedAnswer": { "@type": "Answer", "text": "DNSChanger was a prolific trojan that modified DNS server settings on 4 million computers to route internet requests through rogue servers and commit online ad fraud." } }, { "@type": "Question", "name": "What was Operation Ghost Click?", "acceptedAnswer": { "@type": "Answer", "text": "Operation Ghost Click was a landmark 2011 international law enforcement operation led by the FBI and Estonian police that arrested Vladimir Tsastsin and seized DNSChanger's rogue servers." } }, { "@type": "Question", "name": "Why did the FBI set up temporary replacement DNS servers?", "acceptedAnswer": { "@type": "Answer", "text": "Because shutting down the rogue servers immediately would have disconnected millions of infected computers from the internet, the FBI and ISC operated clean surrogate servers for 8 months." } }, { "@type": "Question", "name": "How did DNSChanger compromise home routers?", "acceptedAnswer": { "@type": "Answer", "text": "DNSChanger sent automated HTTP requests with default credentials (like admin/admin) to local router gateway addresses, rewriting the router's DNS settings for all connected home devices." } }, { "@type": "Question", "name": "How do administrators verify DNS settings are clean?", "acceptedAnswer": { "@type": "Answer", "text": "Inspect network adapter TCP/IPv4 properties to ensure DNS servers are set to legitimate enterprise resolvers or trusted public providers (like 1.1.1.1 or 8.8.8.8) and audit router DNS configs." } } ], "faq_count": 5, "mitre_attack": [ "T1565.001", "T1071.004", "T1112", "T1200", "T1071.001", "T1082" ], "cisa_advisory": null, "last_updated": "2026-06-09", "mitre_attack_detail": [ { "id": "T1562.001", "name": "Impair Defenses: Disable or Modify Tools (Modifying TCP/IP Settings)", "tactic": "Defense Evasion" }, { "id": "T1498", "name": "Network Denial of Service (DNS Redirection)", "tactic": "Impact" }, { "id": "T1562.004", "name": "Impair Defenses: Disable or Modify System Firewall (Blocking AV Updates)", "tactic": "Defense Evasion" }, { "id": "T1189", "name": "Drive-by Compromise", "tactic": "Initial Access" } ], "containment_steps": [ "Open the Windows Network Adapter settings (or `ipconfig /all`) and verify the configured DNS servers against known good corporate or ISP resolvers.", "If rogue IPs are found, flush the DNS cache (`ipconfig /flushdns`) and manually reset the adapter settings to use DHCP or legitimate DNS servers (like 8.8.8.8).", "Run a full antivirus scan to remove the underlying trojan that caused the modification; simply changing the DNS back is insufficient if the malware is still running.", "Monitor enterprise DNS logs for any endpoints attempting to resolve queries against the known rogue Dnschanger subnets." ], "what_to_avoid": [ "Do not assume the internet is 'just broken'; a sudden inability to reach specific sites (especially AV vendors) while others work is a classic sign of DNS hijacking.", "Avoid ignoring the root cause; you must find and remove the dropper executable, or the DNS settings will be hijacked again upon reboot." ], "target_industries": [ "Global / Opportunistic" ], "motivation": "Opportunistic", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "execution", "persistence" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "first_seen": 2007, "lineage": { "derived_from": [], "variants": [ "dnschanger windows pe", "osx.dnschanger (mac os x variant)", "dnschanger router brute-force module" ] }, "attribution": [ { "actor": "Vladimir Tsastsin (Rove Digital) / FBI Operation Ghost Click (SDNY Conviction)", "confidence": "high", "basis": "Estonian national Vladimir Tsastsin and five co-conspirators were arrested in Estonia in November 2011 during Operation Ghost Click. Tsastsin was extradited to the US and sentenced to federal prison in the Southern District of New York in 2016.", "source": "https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-extradition-estonian-national-massive-cyber-fraud-scheme" } ], "exploited_cves": [ "CVE-2008-1447" ], "c2_profile": { "protocols": [ "DNS (UDP/TCP port 53)", "HTTP" ], "ports": [ 53, 80, 443 ], "infrastructure": "Rogue name server clusters hosted in New York and Chicago IP blocks (85.255.112.0/20, 67.210.0.0/16, 93.188.160.0/21) hijacking internet domain resolution, replaced with clean temporary servers by the FBI and ISC until July 2012." }, "iocs": { "file_hashes": [ "2efb6d17b5e4c6981cfda552553ca4be969796ff07a835a96aef71a2ec703ce5", "b1b4c330f89fa6d165f973e20e8b22a08846c4f09a5b3a8634860b0ec89c565d" ], "delivery": [ "Drive-by downloads disguised as video codec updates on untrusted multimedia streaming websites", "Malvertising redirects exploiting browser and media player vulnerabilities" ], "persistence": [ "Direct alteration of TCP/IP registry settings (NameServer and DhcpNameServer keys in Windows registry)", "Automated HTTP brute-force attacks against local gateway routers to alter router-level DNS settings" ] }, "sources": [ { "name": "US DOJ SDNY Press Release - Extradition and Sentencing of Vladimir Tsastsin", "url": "https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-extradition-estonian-national-massive-cyber-fraud-scheme" }, { "name": "FBI National Press Release - Operation Ghost Click", "url": "https://www.fbi.gov/news/stories/operation-ghost-click" }, { "name": "CISA Advisory - DNSChanger Remediation and Working Group", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories" } ], "target_platforms": [ "Windows 11", "Windows 10", "Windows 7" ] }