{
  "family": "dnschanger",
  "sample_count": 11,
  "category": "trojan",
  "description": "Trojan:Win32/Dnschanger is a historically massive and highly impactful malware family that formed the core of **Operation Ghost Click**. Between 2007 and 2011, it infected over 4 million computers globally. Its sole, devastating purpose was to silently modify the Windows TCP/IP settings, redirecting the victim's Domain Name System (DNS) queries to rogue servers controlled by a cybercriminal syndicate. This allowed the attackers to hijack web traffic, inject ads, and prevent users from accessing antivirus updates.<br><br><b>Understanding Dnschanger (Ghost Click)</b><br>To a victim, the internet would slowly become degraded. They would be redirected to fake websites (phishing) when trying to access their bank, or bombarded with injected advertisements on legitimate sites. For a security analyst, DNS hijacking is a fundamental breach of network trust. By controlling DNS, the attacker controls reality for the infected machine, routing them away from legitimate infrastructure entirely.<br><br><b>Execution and Hijacking Mechanics</b><br>Dnschanger was distributed massively via drive-by downloads, exploit kits, and bundled adware (`T1189`). Upon execution, the malware's primary action is to interface with the Windows Registry or the `netsh` utility. It specifically targets the `NameServer` values under `HKLM\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\` (`T1562.001`, `T1498`). It replaces the user's legitimate, ISP-provided DNS server IPs with IPs pointing to the attacker's rogue DNS infrastructure in Estonia or New York. From that point on, every time the user types 'google.com', the rogue server resolves it to a malicious IP. The malware also aggressively blocked access to known antivirus update domains (`T1562.004`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was a total compromise of network routing for millions of users. The primary IoC was the presence of known rogue IP addresses (e.g., `85.255.112.0/20`) configured as the primary/secondary DNS servers in the Windows network adapter settings. Network logs would show all DNS traffic (Port 53) routing to these anomalous subnets rather than corporate or ISP resolvers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1562.004",
    "T1498",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Modifying TCP/IP Settings)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (DNS Redirection)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Blocking AV Updates)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Open the Windows Network Adapter settings (or `ipconfig /all`) and verify the configured DNS servers against known good corporate or ISP resolvers.",
    "If rogue IPs are found, flush the DNS cache (`ipconfig /flushdns`) and manually reset the adapter settings to use DHCP or legitimate DNS servers (like 8.8.8.8).",
    "Run a full antivirus scan to remove the underlying trojan that caused the modification; simply changing the DNS back is insufficient if the malware is still running.",
    "Monitor enterprise DNS logs for any endpoints attempting to resolve queries against the known rogue Dnschanger subnets."
  ],
  "what_to_avoid": [
    "Do not assume the internet is 'just broken'; a sudden inability to reach specific sites (especially AV vendors) while others work is a classic sign of DNS hijacking.",
    "Avoid ignoring the root cause; you must find and remove the dropper executable, or the DNS settings will be hijacked again upon reboot."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}