Hackers Hijack Government and School Subdomains to Promote Illegal Gambling Websites

Hackers have abused government and school domains to promote illegal gambling websites, creating unauthorized subdomains while leaving the institutions’ main websites running normally.

Two unrelated operations used changes to Domain Name System (DNS) records to place gambling pages beneath trusted institutional addresses, borrowing their reputation to attract visitors through search results.

The activity affected institutions in Bangladesh, India, and Mexico. One operation involved more than 850 observed entry points across eight institutional domains and connections to over 30 gambling brands.

These figures describe infrastructure, not confirmed victims or infections, and researchers consider them minimum counts because their investigation was continuing.

Researchers from Infoblox identified the two operations and detailed their findings in an October 26, 2026, report on domain shadowing.

The research describes DNS abuse supporting illegal gambling promotion, rather than a newly identified malware family. How the attackers initially gained access to DNS administration remains unknown.

Hackers Hijack Government and School Subdomains

Domain shadowing allows attackers to add unauthorized DNS records beneath a legitimate domain without changing its main website.

Unlike the previously reported Hazy Hawk subdomain hijacking activity involving abandoned cloud resources, these operations appear to involve unauthorized access to DNS administration. That distinction matters when investigating how control was obtained.

Infoblox tracks the first actor as Hidden Hawk, which appears to sell search visibility to illegal Indonesian gambling brands.

The actor added CNAME records, which make one hostname an alias for another, beneath school and government domains. Most pointed to gambling content hosted externally on Cloudflare Pages rather than institutional servers.

The external hosting names often copied the corresponding institutional hostname, replacing dots with hyphens. This pattern helped researchers reconstruct relationships between the hijacked addresses and hosted pages.

In one documented example, gambling content remained accessible beneath a Bangladeshi secondary school’s domain between July 6 and October 1, 2026.

The use of legitimate hosting services also appears in separate Cloudflare Pages scam campaigns that exploit readily available infrastructure. Here, the important feature was the connection between externally hosted gambling pages and trusted institutional addresses.

Website checks alone could miss the activity because the schools’ and government offices’ primary services remained available. Six Bangladeshi school domains carried approximately 50 to more than 240 entries each, while a Mexican educational domain had over 50.

A Kerala government subdomain hosted gambling content directly and received some school CNAME connections. Researchers observed the Kerala case as remediated in July 2026, although some other infrastructure remained active.

During controlled research, Infoblox contacted a Telegram account believed to belong to Hidden Hawk using a fabricated casino identity.

The operator offered backlink optimization, custom landing pages, and Google AMP pages, supplied payment details, and guaranteed a top Google ranking. Researchers made no payment; the sales pitch matched the infrastructure they observed.

Government DNS Delegations Expanded Attacker Control

The second operation targeted Maharashtra government infrastructure and an ESIC subdomain in India. Rather than adding individual aliases, the attackers created unauthorized nameserver delegations to ClouDNS.

This transferred authority over selected DNS subzones to external nameservers, allowing records beneath them to be managed outside the government’s normal DNS environment. Infoblox has not attributed this activity to Hidden Hawk.

A wildcard record expanded that control by allowing arbitrary names beneath one delegated subzone to resolve.

Gambling-related records appeared from at least August 2025. Content delivery involved DigitalOcean, Amazon CloudFront, and BunnyCDN, with machine-generated doorway pages covering rummy, betting, lotteries, and satta matka.

The delegations disappeared by mid-October 2026, suggesting remediation. The findings add to concerns about gambling infrastructure, although separate casino sites concealing espionage demonstrate a different use of similar-looking content.

In this investigation, the documented purpose was search visibility and traffic acquisition. The evidence does not establish that visitors received malware, or that either operation stole institutional data.

For defenders, the priority is monitoring authoritative DNS changes, not simply checking whether a homepage looks normal.

Unexpected CNAME targets, new nameserver delegations, unexplained wildcard records, and bursts of unfamiliar subdomains require investigation. Certificate-transparency observations should also be compared with approved services and DNS change records.

Organizations discovering unauthorized changes should remove the offending records, review registrar and DNS-provider logs, rotate exposed credentials, and enforce multifactor authentication.

Infoblox cautions against blocking entire legitimate institutional domains. Response should focus on unauthorized hostnames and attacker-controlled infrastructure while addressing the account access or delegation that enabled the abuse. Shared hosting platforms likewise require contextual investigation rather than blanket blocking.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hijack Government and School Subdomains to Promote Illegal Gambling Websites appeared first on Cyber Security News.