Research Links Hazy Hawk to Subdomain Takeovers at 34 U.S. Universities
Summary
A researcher found hijacked subdomains at 34 U.S. universities serving SEO spam. Infoblox linked the campaign to Hazy Hawk; the article explains how abandoned CNAME records enable takeovers and recommends DNS inventory, audits, and cleanup.
Key points
- The researcher reported hijacked subdomains at 34 universities serving explicit spam that Google indexed under trusted .edu domains.
- The described takeover method abuses dangling CNAME records: attackers claim an abandoned external hosting resource and control what the university subdomain serves.
- Infoblox’s VP of Threat Intelligence attributed the campaign to Hazy Hawk, which she said had used the same technique against CDC subdomains.
- The pages were used for search-engine traffic and affiliate advertising; the article also warns of potential email spoofing depending on SPF, DKIM, and DMARC configurations.
- A community member flagged a DoDEA domain as vulnerable to the same pattern; the article says it was reported through DoD channels, not that it was taken over.
- George Washington University reportedly remediated a disclosed issue within 24 hours.
- Recommended defenses include maintaining a DNS inventory, auditing and removing dangling CNAME records, cleaning up DNS when projects end, monitoring subdomains, and reviewing email-authentication policies.
Article Details
- Attack Vectors
- Attackers took over university subdomains with dangling CNAME records by registering accounts on external hosting platforms that matched abandoned targets.
- The hijacked subdomains served explicit pornographic spam optimized for search engines, driving traffic through affiliate advertising networks.
- The article says hijacked subdomains could potentially be exploited for email spoofing, depending on SPF, DKIM, and DMARC configuration; it does not report confirmed spoofing.
- Defensive Notes
- Maintain a documented DNS inventory of subdomains, CNAME targets, and each record's purpose; regularly audit for dangling references and remove records pointing to inactive services.
- Include DNS cleanup in project, staff, and external-service decommissioning processes.
- Monitor subdomains for unauthorized content and review SPF, DKIM, and DMARC settings so protections cover subdomains as well as parent domains.
- The article reports that George Washington University remediated its disclosed issue within 24 hours.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | chemistry[.]mit[.]edu | University subdomain reported as hijacked and used to serve explicit content indexed by Google. |
| HOSTNAME | innox[.]berkeley[.]edu | University subdomain reported as compromised and serving content matching the campaign's spam. |
| HOSTNAME | southasiainstitute[.]harvard[.]edu | University subdomain reported as hijacked and serving spam indexed by Google. |
MITRE ATT&CK
T1584.001 · DomainsThe article describes attackers taking over university subdomains through dangling DNS records and abandoned external hosting targets.T1584.006 · Web ServicesAttackers registered accounts on external hosting platforms matching abandoned targets, then used the resulting hosted sites under hijacked university subdomains.T1608.006 · SEO PoisoningThe hijacked subdomains served spam pages optimized to rank in search engines and attract traffic.
People
Alex ShakhovDiscovered and researched the university subdomain takeover campaign and disclosed findings, including to George Washington University.Henk G.Flagged a DoDEA domain vulnerable to the same attack pattern and said the issue was reported through appropriate DoD channels.Renée BurtonInfoblox VP of Threat Intelligence who said the campaign matched activity her team tracks as Hazy Hawk.