An update on the Kaseya ransomware attack CNC domains

Command and Control Domains

The attack by REvil used several domains, called "Command and Control" domains (also referred to as "C2 domains" or "CNC domains"), which are used after a system has been attacked. The purpose in this case is to notify REvil that the systems had been encrypted.

The configuration file of the ransomware was published by Fabian Wosar on GitHub. From that file, we extracted the list of domains. These domains are not all actually compromised systems—it's likely that only a few are, and the rest are either decoys or have been cleaned up.

Out of an abundance of caution, DNSFilter has marked all of these domains as malicious. We did so on July 3rd, when the domains were first made available. We are doing our best to verify entries and investigate specific aspects of the CNC servers, in order to eliminate false positives from the list.

This was published on GitHub as a service to others—it's an unsorted list in the config file, so making this more easily available could help others who are investigating.

Important notes

The domains shouldn't be taken as a list of compromised systems. It is simply an extract from the config file of domains marked there as "command and control".

If there are any entries that can be verified as clean, please contact us or submit a pull request on the GitHub repository.

Further information

For more information on REvil and the Kaseya ransomware attack, please check out these thorough overviews:

Search
  • There are no suggestions because the search field is empty.
Latest posts
A Smarter Way to Manage Roaming Clients: The New DNSFilter Experience A Smarter Way to Manage Roaming Clients: The New DNSFilter Experience

Managing endpoint security across an organization—whether as an MSP overseeing multiple customers or an admin overseeing a tech stack—should be simple, efficient, and effective. That’s why we’re excited to introduce a revamped Roaming Client management experience, designed to provide greater confidence and ease in managing your fleet of DNSFilter Roaming Clients.

What the ISO 27001 Regulation Means for DNS Security in 2025 What the ISO 27001 Regulation Means for DNS Security in 2025

Why DNS Security Matters for ISO 27001 Certification

DNS security is more than just a technical concern—it’s a pillar of ISO 27001 compliance. As businesses work to protect sensitive data, secure network infrastructure, and meet regulatory requirements, DNS security solutions play a critical role in achieving ISO 27001 certification and ensuring compliance with evolving security standards.

Platform, Fires, and You: Navigating the Fine Line Between Operations and Development Platform, Fires, and You: Navigating the Fine Line Between Operations and Development

The Old-School Operations Role: Backbone or Bottleneck?

In the early days of IT, the operations team was the unsung hero—the silent, and often siloed, force that kept everything running. They were responsible for the infrastructure: Servers, databases, and networks that powered the business. They managed deployments, monitored systems, and ensured uptime. If it was working, no one noticed them. If it wasn't? Well, then the questions started: "Wha...

Explore More Content

Ready to brush up on something new? We've got even more for you to discover.