Hackers Hijack Government and School Subdomains to Promote Illegal Gambling Websites
Two threat actor operations are abusing government and school subdomains via DNS manipulation to promote illegal gambling sites, borrowing trusted institutional reputations.
Two distinct threat actor operations have been observed hijacking government and school subdomains to promote illegal gambling websites. These actors are employing domain shadowing and unauthorized nameserver delegations to associate trusted institutional web addresses with external, illicit gambling content. This tactic leverages the established reputation of legitimate domains to enhance the search engine visibility of illegal operations.
The first operation, tracked by Infoblox as Hidden Hawk, appears to be selling search visibility to illegal Indonesian gambling brands. This actor added CNAME records beneath school and government domains, effectively making a legitimate subdomain an alias for external gambling content. Most of these aliases pointed to gambling pages hosted on platforms like Cloudflare Pages, rather than on the compromised institutional servers. The external hosting names often mimicked the institutional hostnames, further obscuring the malicious activity. Researchers observed this activity affecting institutions in Bangladesh and Mexico, with some domains hosting between 50 to over 240 entries each.
In one documented instance, gambling content remained accessible beneath a Bangladeshi secondary school's domain for several months. The use of legitimate hosting services, such as Cloudflare Pages, is a common tactic in various scam campaigns that exploit readily available infrastructure. The critical element in this operation was the direct link established between externally hosted gambling pages and trusted institutional addresses, making the malicious content appear legitimate.
The second operation, which Infoblox has not attributed to Hidden Hawk, targeted Maharashtra government infrastructure and an ESIC subdomain in India. Instead of creating individual aliases, this actor established unauthorized nameserver delegations to ClouDNS. This action transferred control over specific DNS subzones to external nameservers, allowing records within those subzones to be managed outside the government's standard DNS environment. A wildcard record further expanded this control, enabling arbitrary names beneath a delegated subzone to resolve to malicious content.
This second operation involved gambling-related records appearing from at least August 2025, with content delivery utilizing platforms like DigitalOcean, Amazon CloudFront, and BunnyCDN. Machine-generated doorway pages promoted various forms of gambling, including rummy, betting, lotteries, and satta matka. The unauthorized delegations were eventually removed by mid-October 2026, indicating remediation efforts.
Both operations highlight a sophisticated approach to DNS abuse, focusing on search engine optimization for illicit services by piggybacking on the credibility of educational and governmental entities. The initial access methods for these DNS abuses remain unknown, presenting a challenge for defenders seeking to prevent such compromises. The primary goal appears to be traffic acquisition and search visibility, rather than direct malware distribution or data theft from the compromised institutions.
For organizations, the key takeaway is the importance of monitoring authoritative DNS changes beyond just checking the appearance of a website's homepage. Unexpected CNAME targets, new nameserver delegations, unexplained wildcard records, and a surge in unfamiliar subdomains should all trigger immediate investigation. Certificate transparency logs should also be cross-referenced with approved services and DNS change records to detect anomalies.
Defenders are advised to remove offending records, review registrar and DNS provider logs, rotate any potentially exposed credentials, and enforce multi-factor authentication. The response should focus on the unauthorized hostnames and attacker-controlled infrastructure, while also addressing the root cause of account access or delegation abuse. Blanket blocking of legitimate institutional domains is cautioned against, as the focus should remain on the specific malicious subdomains and attacker-managed infrastructure.