Cloud DNS Takeover Powers Thai Gambling Campaign

## Executive Summary Cyble Research uncovered a global SEO-poisoning campaign in which a suspected single operator claims abandoned cloud DNS delegations (mainly Azure) to host Thai gambling content under trusted corporate subdomains, compromising 163 organizations across 30+ countries; the attacker uses Let’s Encrypt wildcard certificates, a standardized Next.js gambling kit, a 103-node Hong Kong backend, and geographic filtering to target Thai users and evade scanners.