- Cofense Report finds phishing threat players who abuse top-level domains (TLDS)
- A significant number of .gov -domains used in open redirect attack
- Brazil is a leader in .gov domain abuse
Cyber criminals are taking advantage of legitimate government sites and domain services, especially those with .Gov-top-level domains (TLD), experts have warned.
A report from CyberSecurity experts Cofense Intelligence claims that TLDs are used for a wide range of dishonest purposes, from credentials to command and control (C2) operations.
The paper says between November 2022 and November 2024, threat actors utilized vulnerabilities in .gov domains from over 20 countries.
Credential phishing
One of the things the domains is used for is open redirections, which became a key method to bypass Secure E -Mail -Gateways (SEGS).
Open redirections occur when a web application inadvertently allows a user -controlled input to direct traffic to an external place that threat actors can manipulate. Using this tactic can attack redirect unsuspecting victims from legitimate .gov sites to fake pages.
In the United States,. Goves are among the most frequently utilized for these redirections, with more than 77% of the attacks utilizing a specific vulnerability linked to the “nosuchentryrdirect” parameter. This vulnerability, identified as CVE-2024-25608, affects platforms such as Liferay, which was widely used by state organizations. Although US-based .Gov domains made up only 9% of all. Gov domains abused, they ranked third in the overall use.
Credential phishing is still the most common form of abuse tied to .gov domains, the paper explains. The majority of government domains used in phishing attacks hosted nine different files across different campaigns. These phishing trials often mimic legitimate services such as Microsoft, with E emails designed to appear as if they are sent from trusted sources.
The report also notes abuse of .gov domains of credentials and redirection to malicious places were seen in several countries. Brazil in particular stands out as the most targeted country and accounts for most of abuse in .gov domains. However, a small number of domains in Brazil were responsible for most of these assaults, suggesting that attackers were focused on a handful of important government sites.
