Loading threat actor…
Hidden Hawk is a financially motivated threat actor that abuses government and educational domains to promote illegal Indonesian gambling brands through search-engine optimization. Its domain-shadowing operations have affected institutions in Bangladesh, Mexico, and India. The actor's geographic origin and initial method of obtaining access to institutional DNS administration are unknown. Hidden Hawk creates unauthorized CNAME records beneath legitimate institutional domains, directing visitors to externally hosted gambling landing pages, predominantly on Cloudflare Pages. This approach exploits the reputations of trusted domains to improve gambling-related search visibility while leaving institutional homepages operational, making the abuse less apparent during routine website checks. Observed infrastructure comprised more than 850 entry points across eight institutional domains connected to over 30 gambling brands; these figures represent infrastructure counts rather than confirmed victims or infections. Gambling content beneath one Bangladeshi school domain remained accessible from July through October 2026. The operation also maintains link-shortening and image-hosting infrastructure associated with its promotional activity. Its commercial offerings include backlink optimization, custom landing pages, and Google AMP pages. No confirmed malware delivery or theft of institutional data has been established. Separate activity involving unauthorized nameserver delegations and wildcard records beneath Indian government domains has not been attributed to Hidden Hawk.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
23 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.