We discovered compromised routers whose DNS settings had been changed to use shadow resolvers hosted in Aeza International (AS210644), a bulletproof hosting company (BPH) sanctioned by the U.S. Government in July 2025.
The DNS change meant that every device behind that router was serviced not by the local ISP’s DNS resolvers, but by the threat actor. The Aeza resolvers selectively altered the responses, allowing them to direct users to a range of malicious content, all through a DNS resolution.
This shadow network also incorporates an HTTP-based traffic distribution system (TDS), further allowing the actor to fingerprint users and funnel them to content of the actor’s choosing: affiliate advertising platforms.
The combination of an alternate DNS and TDS, along with a clever DNS trick to prevent probing by security groups, has allowed the actor to remain undetected for years. The authoritative servers will not respond to queries that include EDNS0.
#threatintel #threatintelligence #malware #phishing #scam #dns #tds #adtech #affiliateMarketing
