Expired Nameserver Domain Exposed South Korea’s Cyber Agency to DNS Hijacking Risk
Summary
A researcher found South Korea’s NCSC domain still listed two nameservers on expired aegis-k[.]com. The registry referral was fixed, but the agency’s zone still lists them and lacks DNSSEC; the article reports no evidence of abuse.
Key points
- Two of the NCSC’s three nameservers, ns1.aegis-k[.]com and ns2.aegis-k[.]com, relied on a domain that had expired and was available to register.
- A new registrant could have answered DNS queries with chosen addresses, potentially redirecting website visitors or mail and exposing vulnerability reports or other traffic.
- The .kr registry’s referral was corrected by November 8, 2026, and now points ncsc.go.kr to the agency’s own nameserver.
- The agency’s zone still lists the two aegis-k[.]com nameservers, and ncsc.go.kr remains unsigned with DNSSEC, so some resolvers could still use those nameserver entries.
- Researcher Antonio Cheong says he registered the expired nameserver domains he found; aegis-k[.]com was registered again on September 7, 2026, and is paid through September 7, 2027.
- Cheong says his scan found about 21 similar cases on government domains worldwide, but the article identifies only South Korea.
- The article reports no evidence that anyone other than Cheong held the domain, and does not establish that the weakness was exploited.
Article Details
- Event Type
- Expired-domain DNS hijacking exposure affecting South Korea’s National Cyber Security Center
- Impact
- Because two nameservers for ncsc.go.kr pointed to the expired aegis-k.com domain, a person who registered it could potentially have answered some DNS lookups with chosen addresses, redirecting visitors or intercepting mail and traffic, including vulnerability reports. The article reports no evidence that anyone other than Antonio Cheong held the domain. The registry referral has been corrected, but the agency’s own DNS records still list the two nameservers, and ncsc.go.kr remains unsigned with DNSSEC.
People
Antonio CheongIdentified and reported the expired nameserver-domain exposure and says he registered the expired domains he found so nobody else could.LinaResearcher whose August 2026 account of an expired fallback nameserver domain prompted Cheong to investigate; she reportedly renewed that domain before the UK’s NCSC took it over.