Scammers Troll DNS Records for Abandoned Cloud Accounts

A hacking group with apparent access to a commercial domain name system archiving service is on the hunt for misconfigured records of high-reputation organizations in order to blast out links to scammy domains.

See Also: On Demand | Balancing Agility, Cost & Risk in Cloud Environments

A threat actor tracked by cloud security company Infoblox as “Hazy Hawk” came to its attention after a domain belonging to the U.S. Centers for Disease Control and Protection in February “was suddenly hosting dozens of URLs that referenced porn videos.”

“Hazy Hawk is engaged in the unusual work of looking for misconfigured DNS records that point to abandoned cloud resources such as Amazon Web Services S3 buckets and Azure endpoints,” the company wrote Tuesday.

In an operation active since at least December 2023, the threat actor checks the CNAME field of DNS records to see if it points to a cloud service that’s no longer in use. The CNAME field maps one domain onto another, allowing browsers to resolve an alias URL onto a canonical domain. A vulnerability exists when the CNAME field points to a cloud service that no longer exists, giving hackers an opening to create cloud accounts with the same name.

“Perhaps the most remarkable thing about Hazy Hawk is that these hard-to-discover, vulnerable domains with ties to esteemed organizations are not being used for espionage or ‘highbrow’ cybercrime,” Infoblox wrote. “Instead, they feed into the seedy underworld of adtech, whisking victims to a wide range of scams and fake applications.”

Finding dangling CNAME records pointing to abandoned cloud resources isn’t an easy task, meaning that Hazy Hawk likely has access to a passive DNS service that houses historical data about domain name records.

Other victims of the threat actor include the University of California-Berkeley, Dignity Health, Honeywell and Deloitte.

Once Hazy Hawk finds an abandoned cloud resource with a CNAME record, it constructs deceptive URLs that frequently reroute users through platforms such as Blogspot or js.org before directing them into traffic distribution system network. The final payload varies by device and location, ranging from fake CAPTCHAs and app downloads to clickbait or fraudulent offers.

Push notifications play a key role in the operation. Victims tricked into enabling push alerts receive scam links long after the initial interaction, enabling sustained fraud and monetization through underground ad networks. Infoblox linked the push infrastructure to known actors like RollerAds and MoneyBadgers.

As of publication, many of the domains associated with Hazy Hawk’s operations remain active, suggesting the campaign is ongoing.