Prefix hijacking is a network attack in which an attacker announces an IP address block they do not control. Routing systems then send traffic for that prefix to the wrong destination, causing interception, blackholing or impersonation of the intended network. It usually exploits weaknesses in inter-domain routing trust and route validation.
What Prefix Hijacking Means in Routing
Prefix hijacking succeeds because Internet routing accepts announcements that may look valid at a protocol level even when the announcer does not own the address block. The result is not just misdirection, but loss of routing truth, which can reroute, intercept, or blackhole traffic.
At a practical level, the term covers a family of BGP abuse patterns where the attacker’s announcement is more specific, more widely propagated, or simply more trusted than the legitimate route. That makes it a routing integrity problem, not merely a connectivity glitch.
Why Prefix Hijacking Disrupts Traffic
The immediate danger is that traffic follows the wrong path without either endpoint changing anything. Users may see outages, performance degradation, or silently altered paths while operators only observe an apparently ordinary routing convergence event.
Because the attack exploits trust between autonomous systems, it can affect networks far outside the attacker’s own infrastructure. A single incorrect prefix announcement can influence upstreams, downstreams, and transits, especially where filtering and route validation are weak or inconsistent.
How Prefix Hijacking Happens
Prefix hijacking usually depends on one or more of three conditions: a forged or unauthorised route announcement, insufficient prefix filtering, or missing origin validation. The attacker does not need to compromise the destination network itself if they can persuade the routing system to prefer their path.
Operationally, the malicious route may be used for interception, traffic sinkholing, service impersonation, or selective disruption. The same mechanism can also be accidental, which is why route leaks and misconfigurations often sit close to hijacking in real-world investigations.
For a deeper routing-security treatment, see the BGP and Routing Security Guide, which covers route validation, prefix filtering, hijacking, and response practices.
Detection and Response to Prefix Hijacking
Detection starts with knowing what prefixes you legitimately originate and where they should appear. Operators then compare live BGP observations against expected origin AS paths, vendor advisories, and route-monitoring data to spot unexpected announcements quickly.
Response typically focuses on removing the false advertisement, restoring preferred routing, and confirming that traffic has returned to the legitimate origin. Because propagation can lag, operators also need to review whether caches, peers, or downstreams still retain the bad route after the visible announcement disappears.
Where route-origin validation is available, it should be used as a control layer rather than treated as a complete guarantee. Routing-security guidance from the BGP and Routing Security Guide is especially useful here because it ties hijack detection to the specific validation and filtering measures that reduce blast radius.
Risk and Threat Considerations
Prefix hijacking can create confidentiality, availability, and trust failures at the same time. Even when the immediate effect is “just” traffic loss, the same diversion path can enable interception, credential exposure, service impersonation, or hard-to-trace partial outages.
Failure mechanism: The routing system accepts an unauthorised or more-preferred prefix announcement, then propagates that decision through inter-domain routing so traffic is delivered to the wrong network.
Impact: Attackers can blackhole services, intercept sensitive traffic, impersonate a destination, or trigger widespread instability that persists until the false route is withdrawn and converged away.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1584 — Acquire Infrastructure | Prefix hijacking depends on attacker-controlled routing infrastructure and path influence. |
| Recommendation — Track suspicious route-origin infrastructure patterns and correlate them with path manipulation activity. | ||
| NIST CSF 2.0 | PR.DS-04 — Data-at-rest is protected | Routing trust failures can expose traffic confidentiality when interception occurs. |
| DE.CM-01 — The network is monitored to detect potential cybersecurity events | Prefix hijacking is commonly discovered through continuous route and path monitoring. | |
| PR.SC-05 — Resilience is achieved by preparing for and recovering from disruptions | Hijacking creates routing disruption that requires resilience and recovery planning. | |
| Recommendation — Protect routed data paths and limit exposure created by traffic diversion. Monitor BGP origin changes and alert on unexpected prefix announcements. Prepare recovery playbooks for route withdrawal, reconvergence, and traffic restoration. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Routing anomalies are a network-defense problem that needs monitoring and filtering. |
| Recommendation — Deploy monitoring and filtering to identify and block unauthorized route announcements. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org