TECH

Autonomous cybercrime and DNS abuse: Trends shaping the future of digital attacks

Europol warns that, in the coming years, the ability of authorities to respond will depend on the adoption of advanced technologies, legal access to critical data, and much closer collaboration with the private sector.

One of the most disruptive trends is the emergence of autonomous cybercrime. Criminal groups are already using agentic AI systems capable of executing entire attack workflows—from information gathering to intrusion, exfiltration, and monetization—with minimal human intervention. As these tools become more accessible, attackers can distance themselves from operations, reducing the risk of identification and transforming cybercrime into an increasingly intangible threat.

The report also highlights the evolution of hybrid threats, where state-sponsored actors and cybercrime groups collaborate seamlessly. DDoS attacks continue to be used to undermine public trust and generate political instability, while hacker coalitions combine intrusions, data theft, and fraud schemes. The result is a dynamic attack ecosystem where the boundaries between espionage, sabotage, and financial crime are becoming increasingly blurred.

At the heart of this new reality lies DNS abuse, which the IOCTA identifies as one of the critical infrastructures most frequently exploited for online attacks and fraud. DNS acts as a bridge between criminal infrastructure and victims, enabling offenders to launch phishing campaigns, distribute malware, or control botnets via temporary domains. Criminals exploit the lack of automated reporting mechanisms and the slow pace of international legal requests. By the time a malicious domain is finally blocked, the attack has often already reached significant scale.

DNS is equally essential for ransomware and C2 operations, with botnets utilizing residential proxies to mask traffic and mimic legitimate users. This technique hinders detection and makes dismantling criminal infrastructures significantly more complex.

The IOCTA 2026 report emphasizes that the future of cybercrime will be characterized by distributed infrastructure, opaque cryptocurrencies, fragmented markets, and autonomous AI. To narrow the “speed gap” between attackers and law enforcement, Europol advocates for a response grounded in technological innovation, lawful access to critical data, and ongoing international cooperation. Without such adaptation, cybercrime will continue to gain ground.

Domain Name System (DNS) hijacking is a type of DNS attack in which an attacker deliberately manipulates how DNS queries are resolved in order to redirect users to malicious websites. Hackers carry out this attack by installing malware on users' PCs, seizing control of routers, or intercepting/hacking DNS connections.

DNS hijacking can also be used for phishing or pharming. After hijacking the DNS of a legitimate site, attackers direct users to a fake site where they are prompted to enter login credentials or sensitive financial information. Some governments also use DNS hijacking to redirect users to state-approved websites as part of a censorship strategy.

How does a DNS hijacking attack work? When registering a site with a domain registrar, you select an available domain name, and your site's IP address is registered alongside that domain name. For the sake of illustration, let's say you choose the domain name BusinessSite.com.

A DNS record contains your site's unique IP address, linking your domain name to that address. In a DNS hijacking attack, hackers gain access to your DNS settings and change your unique IP address to a different one. Consequently, your domain name—BusinessSite.com—will point to the attacker's servers when the DNS record is queried.

In other words, when someone types "BusinessSite.com" into Chrome, Firefox, or another browser, they are not taken to your actual website. Instead, they are routed to a site controlled by the attacker. If the visitor believes the site they are viewing is legitimate, they might enter sensitive information or inadvertently download malware.

How can DNS hijacking be detected? Common signs of DNS hijacking include slow-loading web pages, frequent pop-up ads on sites where they shouldn't appear, and pop-ups claiming that the user's machine is infected with malware. Fortunately, in addition to these warning signs, there are several online tools you can use to check if your DNS has been hijacked, including:

Network Ping: You can identify DNS hijacking by using a ping utility to ping the questionable domain. You will know your DNS has not been hijacked if the results indicate that the IP address does not exist. Conversely, if you ping the suspicious domain and an IP address appears, there is a good chance your DNS has been hijacked.

Router Check: Attackers can use malware to gain access to your router's administration page. Once inside, they can alter the DNS settings so that the router uses a server managed by the attacker. To check for this type of attack, simply access your router's administration page and verify your DNS settings.

WhoIsMyDNS Check: Another excellent online tool is WhoIsMyDNS, which allows you to identify the actual server responding to DNS requests on your behalf. If the displayed DNS server is unfamiliar to you, you may have fallen victim to DNS hijacking.

Types of DNS hijacking attacks...To prevent DNS hijacking, you first need to understand the different types of attacks. DNS hijacking can take four different forms:

Local DNS hijacking: An attacker installs Trojan horse software on a user's computer and then modifies local DNS settings to redirect the user to harmful websites.

Router-based DNS hijacking: Many routers have weak firmware or use the default passwords they shipped with. Attackers can exploit this to hack a router and change its DNS settings, affecting everyone who uses that router.

Man-in-the-middle (MITM) attacks: Attackers use man-in-the-middle techniques to intercept communications between users and a DNS server. They then redirect the target to malicious websites. Compromised DNS server: Hackers can alter DNS records on a DNS server, allowing them to redirect DNS requests to malicious websites. If the site looks legitimate, the user might not even realize they are in the wrong place.