AWS Route 53 Domain Transferred to Another Account

This threat brief addresses the unauthorized transfer of an AWS Route 53 domain to another AWS account. Route 53 is a scalable DNS web service, and control over a domain allows an attacker to modify DNS records, reroute traffic, and request certificates. The adversary could gain control by compromising an IAM user or leveraging long-lived credentials. Such a transfer can lead to persistence, traffic redirection, phishing attacks, or the staging of infrastructure for more extensive malicious operations. This activity is detected via CloudTrail logs when the TransferDomainToAnotherAwsAccount event is successfully invoked.

Attack Chain

1. An attacker gains unauthorized access to an AWS account through compromised credentials or IAM role exploitation.
2. The attacker identifies a target domain within the Route 53 service.
3. The attacker may disable the domain transfer lock using DisableDomainTransferLock.
4. The attacker initiates a domain transfer to an AWS account under their control using the TransferDomainToAnotherAwsAccount API call.
5. The transfer is successful, granting the attacker administrative control over the domain's DNS records.
6. The attacker modifies DNS records to redirect traffic to malicious servers they control.
7. The attacker sets up phishing sites or redirects legitimate traffic to a command-and-control infrastructure.

Impact

A successful Route 53 domain transfer enables an attacker to fully manage the domain's DNS resources, potentially leading to traffic redirection, service outages, or domain hijacking for phishing or command-and-control. While the exact number of victims and sectors targeted is unknown, unauthorized domain transfers can severely impact any organization relying on AWS for DNS services. This could disrupt service availability, compromise sensitive data through phishing, or enable persistent access to internal networks.

Recommendation

• Deploy the Sigma rule AWS Route 53 Domain Transferred to Another Account to detect successful TransferDomainToAnotherAwsAccount events in AWS CloudTrail logs.
• Monitor AWS CloudTrail logs for DisableDomainTransferLock events followed by TransferDomainToAnotherAwsAccount as it indicates a possible domain transfer preparation.
• Restrict domain transfer permissions to a minimal set of roles using IAM Conditions such as aws:PrincipalArn and aws:MultiFactorAuthPresent as recommended in the AWS Knowledge Center – Security Best Practices.
• Implement change-management tracking for domain ownership modifications, correlating with approved internal requests as noted in the overview.