$10 Domain Could Have Compromised 25,000 Endpoints in Global Cyber Attack

Key Points

• $10 domain could control 25,000 endpoints globally
• Payload disables cybersecurity products and blocks updates
• Affected universities, OT, government, and healthcare networks
• Highlights vulnerability of critical infrastructure

Full Details

Cybersecurity firm Huntress uncovered a sophisticated threat where a single unregistered domain, available for as little as $10, could have granted silent control over more than 25,000 compromised endpoints worldwide. The threat, observed since March 2025, involved a PowerShell-based payload that disables cybersecurity products and blocks updates. Affected hosts included 221 universities, 41 operational technology (OT) networks, 35 government entities, and three healthcare organizations. This highlights the vulnerability of critical infrastructure to low-cost cyber attacks. Huntress's discovery underscores the need for robust domain monitoring and cybersecurity measures.