Australian Drone Firm CubePilot Hit by DNS Hijacking Attack

SYDNEY — Australian drone flight controller developer CubePilot suffered a severe operational disruption on Monday after unidentified threat actors hijacked its Domain Name System (DNS) records. The attack allowed the intruders to intercept network traffic and obtain Transport Layer Security certificates for all of the company's subdomains, effectively compromising the integrity of its digital communications infrastructure.

The incident was detected late Monday evening local time as CubePilot's systems began routing requests through unauthorized servers. By manipulating DNS records, the attackers were able to position themselves between users and CubePilot services, a technique known as man-in-the-middle interception. This access granted them the ability to generate valid TLS certificates for any subdomain associated with the firm, potentially enabling the decryption of encrypted data or the injection of malicious code into software updates.

CubePilot, based in Australia, specializes in open-source flight control systems widely used by hobbyists and commercial operators globally. The company confirmed that its core development environment and customer-facing portals were impacted during the breach window. Immediate steps were taken to isolate affected systems and revoke compromised certificates to prevent further exploitation of user credentials or proprietary code.

Security experts noted that DNS hijacking remains a critical vulnerability for technology firms, as it bypasses many traditional perimeter defenses by redirecting traffic at the routing level rather than attacking application layers directly. The successful generation of TLS certificates indicates that the attackers likely gained access to Certificate Authority validation mechanisms or exploited a weakness in the domain registration process.

No motive has been established for the attack, and no group has claimed responsibility. CubePilot stated it is cooperating with Australian cybersecurity authorities to investigate the scope of the intrusion and determine if any customer data was exfiltrated beyond what could be intercepted during traffic redirection. The company urged users to verify software integrity through official channels once services are fully restored.

As of Tuesday morning, partial restoration efforts were underway, though full service continuity remained uncertain. Questions linger regarding whether the attackers maintained persistent access within CubePilot's network or if they simply executed a targeted disruption before withdrawing. Industry analysts warn that similar vulnerabilities could exist across other drone and aviation software providers relying on comparable DNS configurations.

The incident underscores growing risks to critical infrastructure in the unmanned aerial vehicle sector, where flight control systems are increasingly interconnected with cloud-based services. Until further details emerge about the attackers' capabilities or intentions, CubePilot remains under heightened scrutiny as it works to secure its digital perimeter and restore trust among its user base.