Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Hazy Hawk, a sophisticated threat actor, exploits abandoned cloud resources of high-profile organizations through DNS hijacking. By identifying and taking over dangling CNAME records pointing to unused cloud services, they create malicious URLs on reputable domains. These URLs lead users to scams and malware via traffic distribution systems. Hazy Hawk employs layered defenses, including domain obfuscation and content theft from legitimate websites, to avoid detection. They also leverage push notifications to maintain persistent access to victims. The attacks have impacted government agencies, universities, and major corporations worldwide since at least December 2023. This campaign highlights the importance of proper DNS management and the growing sophistication of cybercriminals in the affiliate marketing space.

The threat campaign titled "Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor" involves a sophisticated adversary known as Hazy Hawk exploiting abandoned cloud resources via DNS hijacking. Specifically, the attacker identifies dangling CNAME DNS records that point to unused or decommissioned cloud services owned by high-profile organizations. By taking control of these orphaned DNS entries, Hazy Hawk can create malicious URLs under legitimate, reputable domains. These URLs are then used to redirect unsuspecting users to scam sites or malware distribution platforms through traffic distribution systems (TDS). The actor employs multiple evasion techniques including domain obfuscation and content theft from legitimate websites to blend malicious content seamlessly, thereby avoiding detection by security tools and users alike. Additionally, Hazy Hawk leverages push notifications to maintain persistent engagement and access to victims, increasing the likelihood of successful exploitation. The campaign has been active since at least December 2023 and has targeted government agencies, universities, and major corporations globally. The attack chain involves exploitation of cloud misconfigurations, DNS hijacking (T1583), exploitation of public-facing applications (T1190), use of traffic distribution systems (T1584), and social engineering tactics such as malicious push notifications (T1608) and user interaction (T1204, T1566). This campaign underscores the critical importance of diligent DNS record management and cloud resource lifecycle governance to prevent attackers from leveraging forgotten infrastructure for malicious purposes.

Detailed information about Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor. Get real-time updates, technical details, and mitigation s

Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor - Live Threat Intelligence - Threat Radar | OffSeq.com

Cloudy with a Chance of Hijacking Forgotten DNS Records Enable Scam Actor

This intelligence update covers recent cybersecurity events. In positive developments, global authorities disrupted a major botnet, arrested a ransomware actor, and dismantled a dark web marketplace. On the negative side, a malicious NPM package was discovered hiding multi-stage malware using Unicode and Google Calendar. The most concerning development involves cyberspies exploiting a zero-day vulnerability in Output Messenger to target Kurdish military users in Iraq, showcasing increased capabilities of the Marbled Dust threat group.

This intelligence update highlights a sophisticated cybersecurity threat involving a zero-day vulnerability identified as CVE-2025-27920 in Output Messenger, a communication platform widely used for internal organizational communications. The vulnerability is actively exploited by the Marbled Dust threat group, a known cyberspy actor, targeting Kurdish military users in Iraq. The exploitation involves malicious binaries such as omclientservice.exe and omserverservice.exe, indicating compromise of both client and server components of the messaging platform. This zero-day allows attackers to gain unauthorized access, enabling espionage activities including data exfiltration, command and control, and persistent access within targeted environments. The attack demonstrates advanced capabilities and a targeted intent by Marbled Dust, emphasizing the threat’s sophistication and potential for long-term compromise.

Additionally, the update reports a malicious NPM package discovered that hides multi-stage malware using obfuscation techniques involving Unicode and Google Calendar, posing a significant supply chain risk to software development environments. This malware could lead to infections, data theft, or lateral movement within networks, especially affecting development pipelines relying on NPM packages.

While positive developments such as disruption of a major botnet, arrest of a ransomware actor, and dismantling of a dark web marketplace are noted, the zero-day exploitation in Output Messenger remains the most concerning due to its targeted nature and potential for persistent espionage. No patch or mitigation is currently available for CVE-2025-27920, and no widespread exploitation beyond the targeted attacks has been reported. Indicators such as the domain api.wordinfos.com may relate to command and control infrastructure or malware communication channels. Overall, this threat represents a sophisticated compromise of a communication platform with significant espionage implications and supply chain risks.

Detailed information about The Good, the Bad and the Ugly in Cybersecurity – Week 20. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'dns hijacking'

Filter Threats

Threats Tagged 'dns hijacking'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility