SILENT PUSH EXAMINES THE DARK SIDE OF DYNAMIC DNS PROVIDERS

Summary from the TLDR InfoSec newsletter

Silent Push identified around 70,000 domains offering rentable subdomains (Dynamic DNS providers) exploited by threat actors due to minimal oversight, cryptocurrency payments, no KYC, and ignoring takedown requests. Major APT groups like APT28, APT29, APT33, Gamaredon, and Scattered Spider extensively use these for C2 infrastructure. While individual malicious subdomains can be blocklisted, parent domains often remain active and spawn new threats. The team created data exports (from the Public Suffix List, afraid[.]org, DuckDNS, NoIP) to help security teams implement risk-based blocking or alerting, balancing security with avoiding disruption to legitimate access.