Drone technology supplier CubePilot is investigating a serious DNS hijacking incident that undermined the trust normally associated with its websites, portals and encrypted connections. The attacker gained control of DNS settings for the cubepilot.org domain on July 24, enabling traffic intended for legitimate company services to be redirected to infrastructure outside CubePilot's control.
The incident became particularly dangerous because the attacker also obtained valid TLS certificates covering CubePilot subdomains. Visitors could therefore have seen the familiar HTTPS indicator while communicating with an attacker-controlled system. This demonstrates an important security lesson: encryption confirms that a connection is protected, but it does not always prove that the service behind it remains under the rightful owner's control.
Potential impact
CubePilot warned that credentials entered into affected services on July 24 may have been captured. Its portal, forum, documentation environment and enterprise resource planning service were among the systems taken offline during the investigation.
The company is also examining the integrity of published firmware. Customers have been told not to flash images downloaded on July 24 or July 25 until the review is complete. Firmware obtained before July 24 is currently considered safe. Customers receiving payment instructions that appear to come from CubePilot should verify them by telephone through an established contact.
What organizations should do
- Reset passwords used on affected CubePilot services and change them anywhere they were reused.
- Review downloaded firmware and software packages against newly published trusted hashes.
- Monitor certificate transparency records for unauthorized certificates covering corporate domains.
- Protect domain registrar and DNS provider accounts with phishing-resistant multifactor authentication.
- Use registry locks, restricted administrative roles and independent alerts for DNS changes.
Expert view
In my view, this incident shows why DNS and domain registrar accounts must be treated as critical infrastructure. An attacker who controls DNS can bypass many assumptions users make about trusted websites, certificates and software distribution. Companies that publish firmware or operational technology should maintain an independently secured channel for signing keys, checksums and emergency customer notifications. That separation can provide customers with a reliable source of truth even when the primary domain has been compromised.