Cyble Finds Abandoned Cloud DNS Takeovers Serving Thai Gambling Pages Across 163 Organizations
Summary
Cyble reports that attackers used abandoned cloud DNS delegations to serve Thai gambling pages on subdomains of 163 organizations across 30+ countries, linking delivery infrastructure to a 103-node backend fleet and outlining detection and remediation steps.
Key points
- Cyble identified 163 affected organizations across more than 30 countries; its report said 161 remained actively compromised at publication.
- The main method was reclaiming abandoned Azure DNS zones; the report also documents DigitalOcean takeovers, wildcard misconfigurations, and individually created DNS records.
- Three OVH delivery nodes served Next.js gambling pages under victim subdomains with valid Let’s Encrypt certificates and affiliate links targeting Thai users.
- Cyble linked a 103-node backend fleet in Hong Kong through shared certificate, HTTP body, JARM, Envoy, and MySQL fingerprints, attributing it to a single operator.
- The report says the campaign exploited lingering DNS delegations rather than breaching victim networks or exploiting application vulnerabilities.
- Recommended defenses include auditing cloud DNS delegations, monitoring unexpected wildcard certificates, testing delegated subdomains, and removing abandoned delegations; rotate DNS credentials if their compromise is suspected.
Article Details
- Attack Vectors
- The operator reclaimed abandoned Azure DNS zones whose delegations remained in victim organizations’ parent DNS zones, then added wildcard A records directing subdomains to delivery infrastructure.
- Two compromised subdomains were delegated to reclaimed DigitalOcean DNS zones; other cases involved wildcard DNS misconfigurations or individually created A records.
- Thai-language gambling pages were served under compromised organization subdomains and reached through organic search results.
- The campaign used affiliate redirects and server-side geographic filtering to direct Thai users to gambling platforms.
- Defensive Notes
- Audit parent-zone NS delegations and verify that each delegated Azure or DigitalOcean DNS zone exists in an actively managed account; remove abandoned delegations.
- Monitor Certificate Transparency logs for unexpected wildcard certificates issued for organization-owned subdomains, particularly after a long period without certificate issuance.
- Test Azure-delegated subdomains with randomized hostnames; unexpected DNS resolution may indicate an active takeover.
- For direct wildcard misconfigurations, remove unauthorized wildcard A records and rotate DNS management credentials if their origin cannot be identified.
- Use the listed delivery IPs, backend indicators, HTTP body MD5, certificate CN, and campaign-specific favicon path for detection and hunting.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | appbox[.]55u4g5g4k2[.]com | Image CDN subdomain for the seven77.click gambling platform, identified as part of the campaign infrastructure. |
| DOMAIN | appbox[.]7y6texmeyy[.]com | Image CDN subdomain for the ibiza99.autos gambling platform, identified as part of the campaign infrastructure. |
| DOMAIN | appbox[.]devh5api27[.]xyz | Image CDN subdomain for the big888.store gambling platform, identified as part of the campaign infrastructure. |
| DOMAIN | big888[.]store | Gambling destination platform identified as part of the campaign’s affiliate monetization layer. |
| DOMAIN | broker-xm[.]com | Domain on the shared Let’s Encrypt certificate deployed across the 103-node backend fleet attributed by Cyble to the campaign. |
| DOMAIN | ibiza99[.]autos | Gambling destination platform identified as part of the campaign’s affiliate monetization layer. |
| DOMAIN | pub-a4952b46ff9c4f6b8d5529cd21f9a1e3[.]r2[.]dev | Specific Cloudflare R2 bucket domain listed as campaign supporting infrastructure. |
| DOMAIN | seven77[.]click | Gambling destination platform identified as part of the campaign’s affiliate monetization layer. |
| DOMAIN | stillsunday[.]pl | Gambling destination platform identified as part of the campaign’s affiliate monetization layer. |
| IPV4 | 139[.]99[.]82[.]106 | Secondary OVH delivery node serving the campaign’s gambling kit. |
| IPV4 | 38[.]127[.]8[.]49 | Tertiary OVH delivery node serving the campaign’s gambling kit. |
| IPV4 | 38[.]173[.]56[.]218 | Hong Kong backend host identified as the entry point from the OVH delivery layer into the campaign’s backend infrastructure. |
| IPV4 | 51[.]79[.]199[.]51 | Primary OVH delivery node serving the gambling kit from compromised organization subdomains. |
| MD5 | 7df3d7cf3358af3f470ac7229387ef94 | HTTP body fingerprint matching across all 103 backend nodes on port 80. |
| SHA1 | d9799ca2f08af6992dc80c49f9889fef40ed27c7 | Certificate fingerprint identified on the primary delivery node. |
| URL | hxxps[:]//link99[.]nova555[.]rest/register/ | Campaign affiliate registration URL shown as the destination of a gambling-page redirect. |
MITRE ATT&CK
T1583.003 · Virtual Private ServerCyble reports the operator used hosted infrastructure, including OVH delivery nodes and a Hong Kong backend fleet.T1584 · Compromise InfrastructureThe campaign reclaimed abandoned DNS zones and used them to serve content under legitimate organizations’ delegated subdomains.T1656 · ImpersonationThe gambling pages were served under trusted enterprise subdomains with valid TLS certificates, presenting as legitimate properties of the affected organizations.
Vendors
DigitalOceanThe operation relied on Azure DNS zone takeovers, a smaller set of DigitalOcean and wildcard misconfiguration cases, and a monetization stack tied to OVH delivery nodes, a Hong Kong backend fleet, and affiliateLet's EncryptThe delivery layer used three OVH-hosted IPs and Next.js gambling pages with valid Let’s Encrypt certificates to appear legitimate under victim domains.Microsoft AzureThe operation relied on Azure DNS zone takeovers, a smaller set of DigitalOcean and wildcard misconfiguration cases, and a monetization stack tied to OVH delivery nodes, a Hong Kong backend fleet, and affiliateOVHa smaller set of DigitalOcean and wildcard misconfiguration cases, and a monetization stack tied to OVH delivery nodes, a Hong Kong backend fleet, and affiliate infrastructure such as link99 and ibiza99vip1.PEG TECH INCdelivery and backend operations, including OVH nodes and the Hong Kong fleet (‘OVH VPS for delivery; PEG TECH INC ASN for backend fleet’).
Products
Azure DNSThe operation relied on Azure DNS zone takeovers, a smaller set of DigitalOcean and wildcard misconfiguration cases, and a monetization stack tied to OVH delivery nodes, a Hong Kong backend fleet, and affiliateDigitalOcean DNSTwo additional compromises involved DigitalOcean DNS takeovers, while others used direct wildcard DNS misconfigurations or per-subdomain A records.
Countries
ChinaWhere every other JARM match represented commodity hosting, this node showed a purpose-built application stack managed from mainland China.Hong Kongand wildcard misconfiguration cases, and a monetization stack tied to OVH delivery nodes, a Hong Kong backend fleet, and affiliate infrastructure such as link99 and ibiza99vip1.
Industries
Critical infrastructureThe campaign compromised 163 organizations across more than 30 countries, including government, healthcare, finance, critical infrastructure, and universities.financeThe campaign compromised 163 organizations across more than 30 countries, including government, healthcare, finance, critical infrastructure, and universities.GamblingCyble reports an SEO poisoning campaign that hijacked abandoned cloud DNS delegations to serve Thai gambling content from 163 compromised organizations across 30+ countries.GovernmentThe campaign compromised 163 organizations across more than 30 countries, including government, healthcare, finance, critical infrastructure, and universities.HealthcareThe campaign compromised 163 organizations across more than 30 countries, including government, healthcare, finance, critical infrastructure, and universities.