Hidden Hawk DNS Hijacking Exploits Public Sites
Threat actors used government domains to host gambling links between August 2025 and October 2026.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust the security of government and school websites you visit?
Beginning in August 2025, a threat group known as Hidden Hawk hijacked DNS records for government and educational institutions in Bangladesh, India, and Mexico to promote illegal gambling websites. The campaign involved creating over 850 unauthorized subdomains.
Why it matters
Attackers leverage the high domain authority of government and academic websites to improve the search engine rankings of illicit content. This form of domain shadowing exploits institutional trust, turning public infrastructure into a distribution network for gambling brands.
The Hidden Hawk operation involved delegating entire DNS subzones to external nameservers, allowing the attackers to manage hostnames independently. The campaign utilized infrastructure from major providers, including Cloudflare, DigitalOcean, Amazon CloudFront, and BunnyCDN.
The players
Infoblox
A cybersecurity firm specializing in DNS security, network identity, and threat intelligence.
Hidden Hawk
A threat actor group identified for using domain shadowing techniques to promote gambling sites.
The details
Domain shadowing occurs when attackers create unauthorized Domain Name System (DNS) records beneath a compromised, legitimate domain to direct web traffic to malicious sites. By delegating subzones to their own name servers, the attackers effectively bypass site oversight to manage sub-sites at scale. Hidden Hawk linked this infrastructure to over 30 separate gambling brands, using the reputation of domains like maharashtra.gov.in to boost traffic.
Timeline
August 2025: Gambling-related activity first observed on institutional domains.
Mid-October 2026: Unauthorized DNS delegations were remediated.
October 26, 2026: Infoblox published investigation findings.
The Tech Race
This campaign follows a pattern of subverting trusted infrastructure to hide malicious activity in plain sight, similar to the 2021 Sunburst supply chain attack. It highlights how threat actors increasingly prioritize subverting institutional trust rather than direct network intrusion.
While the unauthorized delegations were remediated by October 2026, the incident highlights the ongoing risk for users visiting government or academic sites. Network administrators are advised to audit DNS records for unrecognized subzones and ensure strictly controlled access to domain management portals.
The takeaway
Hidden Hawk exploited institutional domain authority to mask illegal activity for over a year. Organizations should implement rigorous monitoring of DNS delegation logs and restrict administrative access to mitigate future domain shadowing threats.
Further reading
For more on evolving threat actor tactics and mitigation, visit Cybersecurity.
Source note: This article includes information reported by CircleID.
Live Poll
Do you trust the security of government and school websites you visit?
