163 Organizations Hit by Thai Gambling SEO Poisoning Campaign
ID: 489224f9-23fc-5ace-bcb4-6b0ea34971e2
STIX ID: report--489224f9-23fc-5ace-bcb4-6b0ea34971e2
Feed Name: The Cyber Express
A large-scale SEO poisoning operation abused abandoned cloud DNS delegations—primarily Azure—to host Thai-language gambling pages on 163 organizations' subdomains across more than 30 countries. Attackers recreated orphaned DNS zones, deployed a Next.js-based gambling kit protected by valid Let's Encrypt wildcard certificates, and monetized via affiliate links while operating a backend fleet of servers; researchers recommend monitoring Certificate Transparency logs, auditing DNS delegations, and removing orphan NS records.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.