Report Details Dead Infrastructure Hijacking Risks and Mitigations
Summary
A threat assessment explains how attackers can reclaim decommissioned domains, SaaS endpoints, and cloud buckets to intercept trusted traffic. It details three attack variants, limitations of CAA and DNSSEC, and organizational and technical mitigations.
Key points
- The report describes three Dead Infrastructure Hijacking variants: unclaimed SaaS CNAME takeovers, expired domain registrations, and cloud bucket squatting.
- Reclaimed endpoints can passively receive sensitive traffic, elicit credentials or session cookies, or deliver malicious artifacts through software pipelines.
- CAA records and DNSSEC do not prevent these scenarios: SaaS platforms may provision certificates automatically, while DNSSEC can correctly resolve to an attacker-reclaimed resource.
- AWS Account Regional Namespaces, introduced March 12, 2026, prevent other accounts from claiming protected names for new S3 buckets; existing buckets remain unprotected, and adoption is opt-in unless enforced.
- The report cites research identifying more than 670 misconfigured Microsoft subdomains and approximately 150 abandoned S3 buckets; it says observed bucket traffic was not answered with malicious payloads.
- Recommended measures include assigning ownership for decommissioning trust relationships, auditing historical DNS and certificate records, retaining domains until dependencies are cleared, and narrowing cookie and wildcard-certificate scope.
Article Details
- Publisher
- CYFIRMA
- Report Period
- Published 2026-03-24; includes research from October 2024 to January 2025 and a separate case dated 2020.
- Scope
- Three dead infrastructure hijacking variants—unclaimed SaaS CNAMEs, expired domains, and cloud bucket squatting—plus related abandoned-C2 sinkholing, cases, technical constraints, and mitigations.
- Sample Size
- No single overall sample; the report describes several case-specific observations.
- Key Statistics
- More than 670 Microsoft subdomains pointing to unclaimed Azure resources were identified in one external DNS audit.
- Approximately 150 abandoned S3 buckets were identified in research conducted from October 2024 to January 2025.
- The re-registered buckets were monitored for two months; observed request types included software updates, binaries, virtual machine images, JavaScript files, CloudFormation templates, and VPN configurations.
- Researchers observed callback traffic from approximately 4,000 already-infected systems after registering expired former C2 domains; the report describes this as sinkholing, not DIH initial access.
- AWS introduced Account Regional Namespaces on 2026-03-12; the protection applies to new buckets and requires adoption or organizational enforcement.
- Recommendations
- Assign cross-functional ownership for decommissioning trust relationships, and retain domains until downstream dependencies have been verified as removed.
- Run CT historical discovery before DNS audits; use dnsReaper, BadDNS, and Nuclei in sequence, and configure real-time CT alerting.
- Use AWS Account Regional Namespace naming for new S3 buckets and enforce it through Service Control Policies; use CloudFormation until Terraform support is available.
- Use subdomain-specific cookie scoping as the primary cookie protection, with SameSite=Strict as defense-in-depth; adopt FIDO2 or passkeys to resist credential harvesting.
- Enumerate wildcard-covered subdomains before DNS audits, migrate elevated-risk subdomains to per-subdomain certificates, and remove wildcard-covered dangling DNS records within 24 hours of discovery.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe report describes attackers using trusted-looking hostnames and wildcard certificate coverage to make hijacked endpoints appear legitimate.T1195.002 · Compromise Software Supply ChainA reclaimed bucket in a CI/CD pipeline could deliver malicious build artifacts downstream; the report says no confirmed malicious supply-chain compromise from this initial access path has been publicly documented.T1213 · Data from Information RepositoriesThe report maps passive collection of internal event records, configuration data, tokens, and telemetry sent to reclaimed endpoints.T1539 · Steal Web Session CookieThe report describes a hijacked subdomain receiving session cookies when they are scoped to the parent domain rather than the specific subdomain.T1566.003 · Spearphishing via ServiceIn the described elicitation scenario, an attacker serves a login clone or reauthentication prompt from a hijacked subdomain to solicit credentials.T1567 · Exfiltration Over Web ServiceThe report describes reclaimed endpoints receiving sensitive data through normal application traffic, including tokens and telemetry.T1583.001 · DomainsIn the described threat scenario, an attacker registers an expired domain still referenced by live systems to receive their traffic.T1584.006 · Web ServicesThe report describes attackers claiming unclaimed SaaS custom-domain mappings or CDN distributions to serve content under trusted subdomains.T1593.002 · Search EnginesThe report maps searches of CT logs and other public records to discover historical subdomains and certificate issuance.T1596.001 · DNS/Passive DNSThe report maps use of historical DNS and Passive DNS data to determine whether a lapsed endpoint previously resolved to a SaaS CNAME or custom domain.T1608.001 · Upload MalwareThe report describes a potential attack path in which malicious artifacts are uploaded to reclaimed cloud storage. It notes no publicly documented confirmed malicious exploitation of cloud bucket squatting.
People
Vendors
Amazon Web Servicesmisconceptions about CAA and DNSSEC, and recommends organizational and technical mitigations including AWS Account Regional Namespaces and CT/historical DNS auditing.GoogleGCS namespace protection: No structural bucket-level namespace protection equivalent to AWS’s Account Regional Namespaces exists for Google Cloud Storage as of this writing.Microsoft[Subdomain ] delegated CNAMEs pointing to unclaimed SaaS/CDN endpoints – docs.example.com, rider-facing subdomain (CloudFront CNAME) and 670 legacy Microsoft subdomains identified in external audits
Products
Amazon CloudFrontto serve malicious or cloned content under trusted subdomains (‘claiming the distribution through CloudFront’s standard account creation flow allowed arbitrary content to be served under the trusted subdomain’)AWS Account Regional Namespacesabout CAA and DNSSEC, and recommends organizational and technical mitigations including AWS Account Regional Namespaces and CT/historical DNS auditing.Azure[Cloud Bucket Name ] S3/GCS/Azure storage names used to intercept pipeline artifacts – mybucket-123456789012-us-east-1-an (AWS Account Regional Namespace example), re-registered abandoned S3 bucket names, and ~150GCS[Cloud Bucket Name ] S3/GCS/Azure storage names used to intercept pipeline artifacts – mybucket-123456789012-us-east-1-an (AWS Account Regional Namespace example), re-registered abandoned S3 bucket names, and ~150Microsoft Azure Blob StorageFor Azure Blob storage, squatting risk operates at the storage account name level, where account names are globally unique rather than at the container level.S3AWS’s Account Regional Namespaces (launched March 12, 2026) removes S3 bucket squatting for new buckets by binding names to account+region, but does not retroactively protect existing buckets and requires opt-in
Tools
BadDNSDetection and tooling sequence matters: run CT historical discovery before DNS audits, use PassiveTotal for historical DNS, and deploy dnsReaper, BadDNS, and Nuclei in sequence for comprehensive exposure identification.dnsReaperDetection and tooling sequence matters: run CT historical discovery before DNS audits, use PassiveTotal for historical DNS, and deploy dnsReaper, BadDNS, and Nuclei in sequence for comprehensive exposure identification.DomainTools IrisImplement domain expiry monitoring using DomainTools Iris as the primary tool for expiry alerting, SecurityTrails for DNS change monitoring, and PassiveTotal for historical DNS baseline and webhook variant determination.NucleiDetection and tooling sequence matters: run CT historical discovery before DNS audits, use PassiveTotal for historical DNS, and deploy dnsReaper, BadDNS, and Nuclei in sequence for comprehensive exposure identification.PassiveTotalDetection and tooling sequence matters: run CT historical discovery before DNS audits, use PassiveTotal for historical DNS, and deploy dnsReaper, BadDNS, and Nuclei in sequence for comprehensive exposure identification.SecurityTrailsImplement domain expiry monitoring using DomainTools Iris as the primary tool for expiry alerting, SecurityTrails for DNS change monitoring, and PassiveTotal for historical DNS baseline and webhook variant determination.