Executive Summary
In April 2026, the threat actor group known as Hazy Hawk executed a coordinated subdomain takeover campaign targeting 34 major U.S. universities, including MIT, Harvard, and Stanford. By exploiting abandoned DNS records pointing to decommissioned cloud services, they hijacked these subdomains to host explicit content, which was subsequently indexed by search engines under the universities' trusted .edu domains. This incident underscores the critical need for organizations to maintain rigorous DNS hygiene and promptly remove or update DNS entries associated with decommissioned services to prevent unauthorized subdomain takeovers.
Why This Matters Now
The Hazy Hawk incident highlights the escalating threat of subdomain takeovers, emphasizing the urgency for organizations to audit and secure their DNS configurations to prevent similar exploits.
Attack Path Analysis
An attacker identifies a dangling DNS CNAME record pointing to a deprovisioned AWS S3 bucket. They register a new S3 bucket with the same name, gaining control over the subdomain. The attacker then serves malicious content from the subdomain, potentially escalating privileges by capturing user credentials. They move laterally by exploiting trust relationships within the domain. Command and control are established through the compromised subdomain, facilitating further attacks. Sensitive data is exfiltrated via the subdomain, leading to significant impact on the organization's reputation and security.
Kill Chain Progression
Initial Compromise
Description
An attacker identifies a dangling DNS CNAME record pointing to a deprovisioned AWS S3 bucket and registers a new S3 bucket with the same name, gaining control over the subdomain.
Related CVEs
CVE-2024-5528
CVSS 5.4A subdomain takeover vulnerability in GitLab CE/EE allows attackers to exploit misconfigurations in GitLab Pages, potentially leading to unauthorized control over subdomains.
Affected Products:
GitLab GitLab CE/EE – < 16.11.6, 17.0.0 - 17.0.3, 17.1.0 - 17.1.1
Exploit Status:
proof of conceptCVE-2023-36474
CVSS 6.1Interactsh server configurations prior to version 1.0.0 are vulnerable to subdomain takeover due to default CNAME entries pointing to GitHub Pages, allowing attackers to host malicious content.
Affected Products:
ProjectDiscovery Interactsh – < 1.0.0
Exploit Status:
proof of conceptCVE-2025-27794
CVSS 6.8Flarum versions prior to 1.8.10 are vulnerable to session hijacking via authoritative subdomain cookie overwrite, allowing attackers to replace session tokens for applications on sibling subdomains.
Affected Products:
Flarum Flarum – < 1.8.10
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Compromise Infrastructure: Domains
Application Layer Protocol: Web Protocols
Phishing: Spearphishing Link
User Execution: Malicious Link
Dynamic Resolution: DNS Calculation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Critical risk from subdomain takeover enabling phishing attacks on banking portals, compromising customer credentials and violating PCI compliance requirements for secure payment processing.
Health Care / Life Sciences
Dangling DNS records expose patient portals to takeover attacks, enabling PHI theft and HIPAA violations through malicious content served via trusted healthcare domains.
E-Learning
Educational platforms vulnerable to subdomain takeover allowing attackers to serve malicious content through trusted academic domains, compromising student and faculty credentials.
Government Administration
Public sector DNS misconfigurations enable threat actors to hijack citizen-facing services, undermining public trust and exposing sensitive government communications to interception.
Sources
- Threat tactic spotlight: Subdomain takeoverhttps://aws.amazon.com/blogs/security/threat-tactic-spotlight-subdomain-takeover/Verified
- CVE-2024-5528: GitLab Subdomain Takeover Vulnerabilityhttps://vulert.com/vuln-db/CVE-2024-5528Verified
- NVD - CVE-2023-36474https://nvd.nist.gov/vuln/detail/CVE-2023-36474Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it embeds security directly into the cloud fabric, reducing the attacker's ability to exploit implicit trust and move laterally within the environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit the compromised subdomain for malicious activities would likely be constrained, limiting their reach within the cloud environment.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges by capturing user credentials would likely be constrained, limiting their access to sensitive resources.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally across systems would likely be constrained, limiting their reach within the cloud environment.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be constrained, limiting their ability to coordinate further attacks.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data would likely be constrained, limiting the potential data loss.
The organization's exposure to reputational damage and financial loss would likely be reduced, limiting the overall impact of the incident.
Impact at a Glance
Affected Business Functions
- Web Hosting
- E-commerce Platforms
- Online Services
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of customer data and sensitive business information due to unauthorized control over subdomains.
Recommended Actions
Key Takeaways & Next Steps
- • Implement continuous monitoring of DNS records to detect and remediate dangling CNAME entries.
- • Enforce strict deprovisioning procedures to ensure DNS records are removed before deleting associated resources.
- • Utilize Cloud Network Security Framework (CNSF) controls to enforce zero trust segmentation and prevent unauthorized access.
- • Apply egress security and policy enforcement to monitor and control outbound traffic from subdomains.
- • Conduct regular security audits and penetration testing to identify and mitigate potential subdomain takeover vulnerabilities.
