Threat actors have exploited DNS administration access at government and educational institutions in Bangladesh, India and Mexico to create hundreds of unauthorized subdomains promoting illegal gambling websites, according to new research from Infoblox. The activity illustrates how attackers can misuse trusted institutional domains without compromising their primary websites.

In an investigation published October 26, Infoblox identified two unrelated operations using a technique known as domain shadowing. Attackers create DNS records beneath legitimate domains, directing visitors to malicious or unauthorized content while leaving the institutions’ existing websites and services intact.

More than 850 unauthorized entry points were identified. One operation, attributed to a group Infoblox calls Hidden Hawk, involved eight institutional domains across the three countries. Researchers linked the activity to more than 30 gambling brands, primarily targeting Indonesian audiences.

Hidden Hawk created individual CNAME records that directed institutional subdomains to externally hosted gambling pages, mostly on Cloudflare Pages. The pages exploited the established reputation of government and educational domains to improve search visibility and attract gambling traffic.

Infoblox researchers also contacted an account believed to represent Hidden Hawk through Telegram. The operator offered search-engine optimization services, including custom landing pages and backlink optimization, suggesting that the group provides promotional infrastructure to multiple gambling businesses. Some compromised subdomains remained active when the research was published.

A separate campaign delegated entire DNS subzones to external nameservers. Attackers targeting India’s maharashtra.gov.in and online.esic.gov.in domains redirected DNS authority for selected subdomains to ClouDNS infrastructure. Unlike individual CNAME records, these delegations allowed the operators to manage numerous hostnames independently of the institutions’ primary DNS environments.

A wildcard record beneath gam.maharashtra.gov.in further enabled arbitrary hostnames to resolve without requiring separate records for each name. Gambling-related activity was observed from at least August 2025, with content delivered through infrastructure including DigitalOcean, Amazon CloudFront and BunnyCDN.

Infoblox reported that the unauthorized delegations were no longer visible by mid-October 2026, suggesting the affected DNS configurations had been remediated.

The initial compromise remains unknown. Researchers could not determine whether attackers obtained DNS access through stolen credentials, insiders, compromised registrars or DNS service providers. The findings nevertheless highlight a security exposure extending beyond website administration to the accounts and services controlling authoritative DNS records.

Because the legitimate institutional websites continued operating, conventional website monitoring could overlook the unauthorized activity. Infoblox recommends monitoring DNS configuration changes, particularly unexpected nameserver delegations, wildcard records, newly created subdomains and CNAME records pointing to unfamiliar hosting services.

The researchers also caution against blocking entire affected government or educational domains. Defensive measures should instead target unauthorized hostnames and attacker-controlled infrastructure while securing the DNS management accounts that enabled the changes.