Hidden Hawk and an unattributed actor use domain shadowing on school and government domains to promote illegal gambling

Linha do tempo

1. gbhackers.com ↗ · pub. 28/10/2026 03:32 · coletado 28/10 04:00

   Hidden Hawk and Unattributed Actor Abuse Indian Government Domains via DNS Shadowing to Promote Illegal Gambling in Google Search

   ler a análise desta fonte ocultar

   Infoblox researchers identified two unrelated operations that abused Indian government and educational domains to promote illegal gambling sites in Google Search through domain shadowing. The legitimate websites kept working while attackers added malicious subdomains through unauthorized DNS changes. One operation, tracked as Hidden Hawk, used 850+ hostnames across eight institutional domains in Bangladesh, India and Mexico. The other, which researchers did not attribute to Hidden Hawk, hit maharashtra.gov.in and online.esic.gov.in with unauthorized NS delegations. The initial access method is unknown; stolen credentials, insider access or a compromised DNS provider are possibilities, not confirmed findings.

   Technical Details

   • Maharashtra operation: unauthorized NS records delegated subzones (gam, games, search, live, dpboss) of maharashtra.gov.in to ClouDNS nameservers. This moved authoritative control of whole subzones outside the government's DNS environment. A wildcard under gam.maharashtra.gov.in let arbitrary subordinate names resolve. Records appeared from at least August 2025, and a similar delegation involved online.esic.gov.in.
   • Content was served first from DigitalOcean, later from Amazon CloudFront and BunnyCDN. Machine-generated doorway pages targeted searches such as rummy, betting, lotteries and satta matka. The delegations were no longer observed by mid-October 2026, suggesting remediation.
   • Hidden Hawk: more than 850 observed entry points across eight institutional domains, supporting over 30 gambling brands (researchers describe both figures as minimums). Most hostnames used CNAME records pointing to Cloudflare Pages, with hosting names that mirror the victim hostname with periods replaced by hyphens.
   • Affected assets include six Bangladeshi school domains, a Mexican educational domain and suneethi.sjd.kerala.gov.in (remediated by July 2026).
   • Researchers posing as a casino operator in Telegram conversations were offered backlink optimization, custom landing pages and Google AMP pages, with guaranteed rankings that were not independently verified. No payment was made.
   • Because external platforms host the content, monitoring of institutional homepages or application logs could miss the abuse.

   Remediation

   • Audit authoritative zones for unexpected CNAMEs, external NS delegations, wildcard records and unexplained hostname creation.
   • Use certificate transparency and passive DNS to find unfamiliar subdomains.
   • Remove unauthorized records, investigate account activity, rotate potentially compromised credentials and enforce multifactor authentication.
   • Block the malicious hostnames and associated infrastructure rather than whole legitimate government or school domains, to avoid collateral disruption.
2. infoblox.com ↗ · pub. 26/10/2026 10:00 · coletado 26/10 11:01 primeiro registro

   Hidden Hawk and an unattributed actor use domain shadowing on school and government domains to promote illegal gambling

   ler a análise desta fonte ocultar

   Infoblox identified two unrelated operations that used domain shadowing to place illegal gambling doorway pages beneath legitimate school and government domains for SEO. In both cases an unauthorized party appears to have gained access to DNS administration and created records the owners may not have noticed. The access method is unknown. The actor tracked as Hidden Hawk sells SEO infrastructure via Telegram to Indonesian gambling brands. A separate, unattributed campaign abused maharashtra.gov.in and online.esic.gov.in in India. Reported figures are minimums because research was ongoing.

   Technical Details

   • Hidden Hawk: added individual CNAME records under institutional domains, mapping them mostly to Cloudflare Pages (pages.dev) hostnames. The pages.dev name usually reproduced the victim hostname with dots replaced by hyphens. Infoblox found more than 30 gambling brands and more than 850 entry points across eight institutional domains in Bangladesh, India and Mexico. Reused prefixes include Omacuan and slot-gacor. Landing pages shared actor-operated link-shortening and image-hosting infrastructure. One example, link.omacuan.amc.edu.et.raahs.edu.bd, served gambling content from July 6 to October 1, 2026.
   • Telegram engagement: researchers posing as a casino operator were offered backlink optimization and custom landing pages, including Google AMP pages. Pricing was in USD and IDR with Indonesian bank-payment details. The operator guaranteed a top Google ranking. No payment was made.
   • Maharashtra/ESIC case: the actor delegated subzones (gam, games, search, live, dpboss) of maharashtra.gov.in to ClouDNS nameservers and used a wildcard under gam.maharashtra.gov.in. A similar delegation was seen for online.esic.gov.in. Gambling records appeared from at least August 2025. Content was delivered via DigitalOcean, Amazon CloudFront and BunnyCDN, with machine-generated doorway pages (rummy, betting, lottery, satta matka). The delegations were no longer observed in mid-October 2026. Infoblox has not attributed this activity to Hidden Hawk.
   • Infoblox lists the compromised domains maishadihighschool.edu.bd, suneethi.sjd.kerala.gov.in and escuelanormallarrainzar.edu.mx as Hidden Hawk victims.

   Remediation

   • Monitor authoritative zone changes, especially new subdomains, NS delegations, wildcards and CNAMEs pointing to unexpected hosting services.
   • Secure every account able to change DNS, including registrar and DNS provider accounts.
   • Block the unauthorized hostnames and actor infrastructure, not the legitimate institutional second-level domains.
   • Remediate the DNS account or delegation that enabled the abuse.