HAZY HAWK GANG EXPLOITS DNS MISCONFIGS TO HIJACK TRUSTED DOMAINS

Summary from the TLDR InfoSec newsletter

A threat actor tracked as Hazy Hawk is hijacking abandoned DNS CNAME records pointing to abandoned cloud services to distribute scams, fake apps, and malicious apps. Hazy Hawk scans for domains with dangling CNAME records, then registers a new cloud resource with the same name as the abandoned CNAME, and finally creates hundreds of malicious URLS under it that redirect users to scam sites. It has hijacked subdomains from cdc[.]gov, ted[.]com, nyu[.]edu, and unicef[.]org among others.