CubePilot drone software dev hit by DNS hijacking to intercept traffic

Published:

28 juli 2026 om 21:17:39

Alert date:

28 juli 2026 om 22:02:06

Source:

bleepingcomputer.com

Network Infrastructure, Critical Infrastructure, Identity & Access, Data Breach & Exfiltration

CubePilot, an Australian company specializing in flight controllers for drones and UAVs, suffered a significant operational disruption due to a DNS hijacking attack. The attack allowed threat actors to intercept and redirect traffic intended for CubePilot's infrastructure. DNS hijacking involves modifying DNS records to point domain names to attacker-controlled servers, enabling interception of communications, credential theft, or distribution of malicious content. The incident highlights the risk of DNS-based attacks against technology companies in the defense and aerospace supply chain. CubePilot's products are widely used in commercial and potentially military UAV applications, raising concerns about the broader security implications. The attack represents a serious threat to the integrity of software updates and communications for drone operators relying on CubePilot systems.

Technical details

On July 24, 2026, an attacker gained unauthorized control of the DNS settings for the cubepilot[.]org domain. This DNS hijacking allowed the attacker to redirect traffic intended for CubePilot's internal systems to attacker-controlled infrastructure. The attacker also fraudulently obtained TLS/SSL certificates covering all cubepilot.org subdomains, enabling valid HTTPS connections to be presented to users while they were actually communicating with malicious infrastructure. This meant credentials entered on any cubepilot.org service (including the portal and community forum) on July 24 may have been intercepted. There is also a concern that firmware images published or downloaded on July 24-25 may have been tampered with or replaced. CubePilot regained control of its domains on July 24, revoked the fraudulently issued certificates, preserved forensic evidence, and notified relevant providers, the Australian Cyber Security Centre, and law enforcement. The ERP portal, OEM services, community forum, and documentation portal were taken offline as precautions.

Mitigation steps:

1. If you logged into any CubePilot service (portal, forum, or any cubepilot.org subdomain) on July 24, 2026, immediately change your password for that service and any other service where you reuse the same password. 2. Do not flash or use any firmware images downloaded from CubePilot on July 24-25, 2026 until CubePilot confirms their safety. Firmware obtained before July 24 is currently considered safe. 3. If you receive any payment requests claiming to be from CubePilot, do not take action — verify them via phone with your usual CubePilot contact before proceeding. 4. Monitor for any unauthorized account activity on services where CubePilot credentials may have been reused. 5. Wait for CubePilot's direct notification if your account or data was confirmed to be impacted by the breach. 6. Check for revoked or fraudulently issued TLS certificates for cubepilot.org subdomains as an indicator of compromise in your security logs.

Affected products:

CubePilot cubepilot.org domain and DNS infrastructure
CubePilot OEM services portal
CubePilot community forum
CubePilot documentation portal
CubePilot ERP portal
CubePilot firmware images (downloaded July 24-25
2026)