Cyble Research & Intelligence Labs uncovered an active SEO poisoning campaign exploiting abandoned Azure DNS zone delegations to serve Thai-language gambling content under the domain authority of 163 enterprise organizations across 30+ countries. The attack works by identifying subdomains whose NS records still point to Azure DNS after the underlying subscription was canceled, then claiming the orphaned zone under a new Azure subscription, adding a wildcard A record, and obtaining a valid Let's Encrypt wildcard TLS certificate — all resolving cleanly under the victim's own domain. The campaign compromised federal agencies, healthcare systems, financial institutions, and universities, with some delegations left abandoned for over six years. A 103-node backend fleet in Hong Kong handles the application layer, while three OVH delivery nodes serve the gambling kit. The operation monetizes through a dual-tier affiliate commission structure with server-side geographic filtering targeting Thai users. Detection requires Certificate Transparency log monitoring and DNS delegation auditing, as conventional security controls produce no signal. Remediation involves removing stale NS delegations and auditing all cloud-delegated subdomains.
