Share this
An update on the Kaseya ransomware attack CNC domains
by Peter Lowe on Jul 9, 2021 12:00:00 AM
Command and Control Domains
The attack by REvil used several domains, called "Command and Control" domains (also referred to as "C2 domains" or "CNC domains"), which are used after a system has been attacked. The purpose in this case is to notify REvil that the systems had been encrypted.
The configuration file of the ransomware was published by Fabian Wosar on GitHub. From that file, we extracted the list of domains. These domains are not all actually compromised systems—it's likely that only a few are, and the rest are either decoys or have been cleaned up.
Out of an abundance of caution, DNSFilter has marked all of these domains as malicious. We did so on July 3rd, when the domains were first made available. We are doing our best to verify entries and investigate specific aspects of the CNC servers, in order to eliminate false positives from the list.
This was published on GitHub as a service to others—it's an unsorted list in the config file, so making this more easily available could help others who are investigating.
Important notes
The domains shouldn't be taken as a list of compromised systems. It is simply an extract from the config file of domains marked there as "command and control".
If there are any entries that can be verified as clean, please contact us or submit a pull request on the GitHub repository.
Further information
For more information on REvil and the Kaseya ransomware attack, please check out these thorough overviews:
Share this

Managing endpoint security across an organization—whether as an MSP overseeing multiple customers or an admin overseeing a tech stack—should be simple, efficient, and effective. That’s why we’re excited to introduce a revamped Roaming Client management experience, designed to provide greater confidence and ease in managing your fleet of DNSFilter Roaming Clients.

Why DNS Security Matters for ISO 27001 Certification
DNS security is more than just a technical concern—it’s a pillar of ISO 27001 compliance. As businesses work to protect sensitive data, secure network infrastructure, and meet regulatory requirements, DNS security solutions play a critical role in achieving ISO 27001 certification and ensuring compliance with evolving security standards.

The Old-School Operations Role: Backbone or Bottleneck?
In the early days of IT, the operations team was the unsung hero—the silent, and often siloed, force that kept everything running. They were responsible for the infrastructure: Servers, databases, and networks that powered the business. They managed deployments, monitored systems, and ensured uptime. If it was working, no one noticed them. If it wasn't? Well, then the questions started: "Wha...