Pretty sure you're right. The US-CERT advisory for this campaign implies the attackers were logging into the targets accounts at registrars or DNS providers dir

Pretty sure you're right. The US-CERT advisory for this campaign implies the attackers were logging into the targets accounts at registrars or DNS providers directly. https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS-Infrastructure-Hijacking-Campaign https://www.us-cert.gov/ncas/current-activity/2019/01/10/DNS...