$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks

Researchers at Huntress discovered that malware disguised as adware from Dragon Boss Solutions had evolved to disable antivirus software and disable security updates on over 25,000 compromised computers worldwide. The most alarming finding was that the malware's update domain was unregistered, meaning anyone could have purchased it for as little as $10 to take complete control of infected systems, including those at 324 high-value targets like universities, government agencies, operational technology networks running critical infrastructure, and Fortune 500 companies. Huntress registered the domain themselves to prevent exploitation, highlighting how a simple oversight could have enabled massive cyber attacks across sensitive networks in 124 countries.