AI Weaponizes Dangling DNS Takeovers, Expanding Attack Surface and Automation

The Threat of Dangling DNS Takeovers

A 'dangling DNS takeover' occurs when a DNS record continues to point to a cloud resource after that resource has been deleted. This leaves a 'dangling' link that attackers can exploit. By finding this link and recreating the cloud resource under their control, attackers can take over the subdomain. Historically, these attacks have been used by cybercriminals for financial gain.

AI as a Force Multiplier

Security firm Silent Push investigated how a nation-state attacker, prioritizing chaos over monetization, could leverage AI for these attacks. Their research, named 'DangleGeddon', demonstrated that AI acts as a force multiplier. It massively expanded domain and subdomain discovery, using tools like Claude Opus 5 for context-enriched takeover script generation, targeting 12,500 domains.

Automated Exploitation and Expanded Targets

AI was also used to filter out resources lacking allocation or DNS registration, refining a large dataset into a precise list of several hundred exploitable targets. This process identified new targets, broadening the attack surface beyond what human attackers typically find. The researchers were then able to automate the infrastructure build-out for exploitation, making a 'DangleGeddon' scenario a real threat within minutes.

Real-World Vulnerability Demonstrated

Silent Push conducted safe tests to examine potential attacker capabilities. In one instance, a US federal government domain had a dangling record pointing to an unassigned Azure blob storage container. A takeover allowed the creation of phishing pages that bypassed government trust filters, demonstrating the severe implications of such vulnerabilities when weaponized by AI.