The Russian internet suffered from massive domain theft.

Reports of a massive theft of domain names from the .RU zone have surfaced on the RuNet. This was reported by representatives of the hosting provider Net Angels.

Over the course of three days, from June 3 to 6, attackers were able to gain control over several hundred domains.

An old and well-known scheme was used to steal the domains. The attackers search for domains registered to email addresses on mail.ru and bk.ru. They then search for unused domains, register the vacated email addresses in their own names, and request password recovery on the nic.ru website.

In the next stage, the attackers changed the nameservers. All hacked domains received a link to nameservers in the 62.122.75.0/24 subnet.

The described scheme isn't outright theft, as transferring a Russian domain to another person requires a paper application. However, the situation described demonstrates vulnerabilities in the Mail.ru email service and the registrar.

RU-CENTER.