Skip to main content

Cybersecurity report

Home Routers Under Attack via DNSChanger Malware on Windows, Android Devices

Proofpoint, December 13, 2016. That the 2016 'DNSChanger' activity is an unrelated router-targeting exploit kit delivered through malvertising, not a return of the Rove Digital DNSChanger operation taken down in 2011: it attacks SOHO router vulnerabilities from the victim's browser and carries no operator, infrastructure or code continuity with Rove Digital..

Source type
Cybersecurity report
Published
December 13, 2016
Research grade
T2
Used in entries
1

Bibliographic record

Publisher
Proofpoint
Published
December 13, 2016
Source type
Cybersecurity report
Research grade
Source grade T2
Language
English
Official record
Not an official publication
Address
https://www.proofpoint.com/us/blog/threat-insight/home-routers-under-attack-dnschanger-malware-windows-android-devices
What it supports
That the 2016 'DNSChanger' activity is an unrelated router-targeting exploit kit delivered through malvertising, not a return of the Rove Digital DNSChanger operation taken down in 2011: it attacks SOHO router vulnerabilities from the victim's browser and carries no operator, infrastructure or code continuity with Rove Digital.
Dataset id
src_proofpoint_dnschanger_ek_2016

Research notes

  • By Kafeine (Proofpoint threat research). Page header reads 'December 13, 2016'; article:published_time is 2016-12-13T11:06:47-08:00.
  • The post carries an in-line note '[Updated December 19, 2016 to reflect additional data received from one of the affected traffic brokers...]' - the original publication date is 2016-12-13.
  • Name collision only: the post never mentions Rove Digital, the 2011 Operation Ghost Click takedown or the substitute DNS servers.

How this source is used

Cited 1 time across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

Cited by

Later activity

1 citation

Cited for activity recorded after the takedown.

All sources