CubePilot Reports DNS Hijacking That May Have Exposed User Credentials
Summary
CubePilot says an attacker hijacked its DNS on July 24, redirected traffic, and obtained TLS certificates, so credentials may have been captured. The company restored control, revoked certificates, and advised password resets and avoiding firmware downloaded July 24–25.
Key points
- CubePilot says an attacker took control of its DNS settings on July 24 and redirected traffic intended for its services.
- The attacker obtained TLS certificates covering all cubepilot[.]org subdomains, allowing redirected services to appear as valid HTTPS connections.
- CubePilot said credentials entered on affected services, including its portal and forum, may have been captured; this is a reported risk, not confirmed credential theft.
- The company says it regained domain control, revoked the certificates, preserved evidence, notified providers, and reported the incident to Australian authorities and law enforcement.
- CubePilot's OEM services, community forum, documentation portal, and ERP portal were offline while the company investigated.
- CubePilot advised users to change reused passwords and avoid firmware images downloaded July 24–25 until safety checks are complete; images obtained before July 24 were considered safe at the time of the report.
- The company advised customers to verify unexpected payment requests by phone with their usual contact.
Article Details
- Victim Organization
- CubePilot
- Victim Domain
- cubepilot.org
- Incident Type
- DNS hijacking that redirected traffic to attacker-controlled infrastructure and enabled potential credential interception
- Data Types Exposed
- User credentials (potentially captured)
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- CubePilot regained control of its domains and revoked the fraudulently issued TLS certificates. OEM services, the community forum, and documentation portal were offline; the ERP portal was also taken offline as a precaution. Firmware downloaded on July 24–25 was under review.
- Ransom Or Extortion
- No ransom or extortion is reported. CubePilot warned clients not to act on payment requests claiming to be from the company and to verify them by phone.
- Claim Status
- confirmed