CubePilot Reports DNS Hijacking Attack Enabling Traffic Interception

What Happened

CubePilot, an Australian manufacturer of drone (UAV) flight controllers, disclosed a significant operational disruption stemming from a DNS hijacking attack, according to a report from BleepingComputer. The attackers reportedly manipulated DNS records to redirect and intercept traffic intended for CubePilot's infrastructure.

Specific technical details about the attack vector — such as whether the compromise occurred at the domain registrar, DNS provider, or through credential theft — have not been fully disclosed in the available reporting.

Why It Matters

DNS hijacking against a hardware and firmware vendor is particularly concerning because it can potentially be leveraged to intercept or tamper with software updates, downloads, and customer-facing services before victims realize anything is wrong. For a company supplying flight controllers used across the drone/UAV ecosystem, downstream customers and integrators relying on CubePilot's domains for firmware, documentation, or communications could be exposed to interception or manipulation of that traffic during the hijack window.

This incident is a reminder that supply-chain risk isn't limited to code repositories — DNS infrastructure is an equally attractive target for attackers seeking to intercept traffic at scale or stage further compromise.

What Defenders Should Watch For

• Organizations relying on CubePilot software, firmware, or downloads should review DNS resolution logs for the relevant time period for anomalous A/AAAA/NS/MX record changes tied to CubePilot domains.
• Verify integrity (checksums/signatures) of any firmware or software downloaded from CubePilot around the disclosed timeframe before deploying to devices.
• More broadly, defenders managing their own domains should monitor registrar and DNS provider accounts for unauthorized changes, enforce MFA and registry locks on domain management accounts, and consider DNSSEC and certificate transparency monitoring to detect hijacking attempts early.
• Watch for unexpected TLS certificate issuance for owned domains, which can indicate an attacker has gained DNS control sufficient to pass domain validation.

Developing Story

This is a net-new, developing incident, and further technical details from CubePilot or additional reporting may refine the scope and root cause. For the original report, see BleepingComputer's coverage.