A new technique known as domain shadowing is becoming increasingly popular amongst threat actors. Domain shadowing relies on DNS hijacking, an attack where the threat actor compromises the registrar or DNS service provider, the DNS server itself, or by utilizing dangling domains, which are domains that were abandoned by their previous owner and can be reregistered by the threat actor. Once a threat actor obtains a domain name through one of these methods, they can use domain shadowing to hide their command and control (C2) infrastructure. Leaving the second-level domain (ex. “example” in the domain example.com) unaffected, the threat actor registers a new subdomain pointing to their C2 infrastructure’s IP address. To a victim accessing the domain, most checks on the domain name would return a benign result, as the second-level domain is a legitimate website. Research from Palo Alto’s Unit 42 discovered a phishing campaign involving Russian IP addresses that utilizes domain shadowing. The threat actors hijacked domains hosted in Australia and the US and covertly added randomly generated subdomains to their DNS entries. The threat actors then hosted phishing login pages to steal Microsoft account credentials. The researchers also theorized botnets could utilize this technique to proxy C2 traffic to a dedicated server. To attempt to detect the use of domain shadowing, the researchers built a machine learning algorithm classified to detect hijacked domains using multiple identifiers. CTIX analysts are monitoring the use of this technique and will provide updates for new developments.