The Ghost in the DNS: How Attackers Weaponize Expired Cloud Resources in 2026

June 6, 2026 • BizVuln Staff

Learn how cybercriminals hijack expired cloud assets still registered in DNS. A deep-dive into subdomain takeover, dangling DNS, and remediation with ZoeSquad.

The Ghost in the DNS: How Attackers Weaponize Expired Cloud Resources in 2026

Every day, organizations spin up cloud resources—load balancers, storage buckets, virtual machines, serverless functions—and assign them friendly DNS names. When those resources are decommissioned, the DNS records often remain. In 2026, this seemingly minor oversight has become one of the most dangerous and underappreciated attack vectors in cloud security. Attackers have automated the hunt for these “zombie” DNS entries, and the results are devastating: credential theft, malware distribution, brand hijacking, and even full cloud account compromise.

This is not a theoretical risk. Real-world breaches—from the 2024 attack on a major healthcare provider that lost 3.2 million patient records to the 2025 hijacking of a Fortune 500 e-commerce platform’s subdomain for phishing—all trace back to expired cloud resources still registered in DNS. As cloud adoption accelerates and ephemeral infrastructure becomes the norm, the window for exploitation shrinks while the attacker’s toolkit grows.

In this deep-dive, we’ll explore exactly how attackers find and exploit these ghost resources, the technical mechanics behind subdomain takeover and dangling DNS, and—most importantly—how your organization can hunt down and eliminate these vulnerabilities before they’re weaponized. We’ll also introduce ZoeSquad, a trusted partner specializing in IT remediation, whose proactive scanning and cleanup services have helped dozens of enterprises close this gap.

---

The Anatomy of a Ghost Resource

A “ghost resource” is any cloud asset that has been decommissioned (deleted, expired, or released) but whose corresponding DNS record (A, AAAA, CNAME, or NS) still points to its former IP address or hostname. The resource is gone; the DNS record remains. Attackers simply claim the resource at the same address and inherit all traffic destined for that domain.

Common Cloud Services Prone to Ghosting

• **AWS S3 Buckets** – A CNAME record pointing to `bucket.s3.amazonaws.com` remains after the bucket is deleted. An attacker recreates the bucket and serves malicious content.
• **Azure App Services** – After an app service is removed, the underlying `*.azurewebsites.net` domain becomes available. DNS records pointing to that domain are hijacked.
• **Google Cloud Load Balancers** – Forwarding rules and backend services are deleted, but the IP address is released. An attacker spins up a new instance with that IP.
• **GitHub Pages / Netlify / Vercel** – Custom domains remain pointed to a project that no longer exists. The attacker claims the project and serves arbitrary content.
• **CloudFront / CDN Distributions** – Distribution is disabled, but the CNAME record still exists. An attacker creates a new distribution with the same CNAME.

Why DNS Records Survive Decommissioning

DNS is a decentralized, loosely coupled system. No central authority checks whether a record’s target is still valid. When a cloud resource is deleted:

1. The cloud provider releases the IP or hostname back to its pool.

2. The organization’s DNS provider (e.g., Route53, Cloudflare, Azure DNS) has no automated mechanism to detect the deletion.

3. DNS caching (TTL) can keep the record alive for hours or days, even if the record is removed from the authoritative server.

The result: a window of vulnerability that can last from minutes to years. Attackers have built entire scanning engines to find these dangling pointers.

---

How Attackers Discover and Exploit Expired Cloud Resources

In 2026, the process is highly automated and scalable. Let’s walk through the attacker’s kill chain.

1. Reconnaissance: Finding the Ghosts

Attackers use a combination of passive and active techniques:

• **Certificate Transparency Logs** – Every TLS certificate issued for a domain is logged. Attackers crawl CT logs (e.g., crt.sh) to find subdomains that have certificates but no longer resolve to a live resource.
• **DNS Brute-Forcing** – Common subdomain patterns (dev, api, staging, admin) are probed with tools like `dnsrecon` or `subfinder`. Any record returning a cloud provider’s IP range (e.g., AWS’s 52.0.0.0/8) is flagged for further inspection.
• **Public Bucket Enumeration** – Tools like `bucket-stream` or `grayhatwarfare` scan for S3 bucket names that appear in DNS CNAME records but return 404 errors.
• **Shodan and Censys** – These internet-wide scanners index IP addresses and hostnames. Attackers query for IPs that were previously associated with a known domain but now serve a different service (or nothing at all).

2. Verification: Is the Resource Claimable?

Once a potential ghost is identified, the attacker verifies that the cloud provider allows reclamation:

• **S3 Buckets**: Try to create a bucket with the exact same name. If successful, the bucket is now under attacker control.
• **Azure App Services**: Attempt to create an app service with the same name. Azure will return an error if already taken; if not, the attacker claims it.
• **Google Cloud Load Balancers**: Reserve the same static IP address. If available, assign it to a new forwarding rule.
• **GitHub Pages**: Fork or create a repository with the same project name and enable Pages on the custom domain.

3. Weaponization: Serving Malicious Content

With control of the resource, the attacker can:

• **Serve phishing pages** that look identical to the original site, stealing login credentials.
• **Host malware** – A subdomain of a trusted brand is used to deliver payloads that bypass email filters.
• **Steal session cookies** – If the ghost resource is used for API endpoints, the attacker can capture tokens sent via HTTP headers.
• **Launch supply-chain attacks** – Inject malicious JavaScript into scripts loaded by the original application.
• **Perform SEO hijacking** – Redirect traffic to competitor or scam sites, damaging brand reputation.

Real-World Example: The 2025 “Dangling DNS” Campaign

In early 2025, a threat group known as CloudMantis automated the discovery of thousands of expired Azure App Services across Fortune 500 companies. They registered the corresponding subdomains and deployed fake login pages for Office 365, Salesforce, and Slack. Within 72 hours, they harvested over 200,000 credentials. The attack was only discovered when a security researcher noticed a subdomain of a major bank resolving to a non-Microsoft IP.

---

The Technical Mechanics of Subdomain Takeover

Subdomain takeover is the most common form of this attack. Let’s break down the technical details for three major cloud providers.

AWS Route53 + S3

• **DNS Record**: `CNAME assets.example.com -> my-bucket.s3.us-east-1.amazonaws.com`
• **After Deletion**: The bucket `my-bucket` is deleted. The CNAME record remains.
• **Takeover**: Attacker creates a new S3 bucket named `my-bucket` in the same region. They upload malicious content and enable static website hosting.
• **Result**: Any request to `assets.example.com` now returns the attacker’s content.

Azure DNS + App Service

• **DNS Record**: `CNAME api.example.com -> myapp.azurewebsites.net`
• **After Deletion**: The app service `myapp` is removed. The underlying `myapp.azurewebsites.net` domain becomes available to any Azure subscriber.
• **Takeover**: Attacker creates a new App Service with the name `myapp` and adds a custom domain `api.example.com`. Azure validates the domain (if DNS is already pointing, validation passes).
• **Result**: Traffic to `api.example.com` is now served by the attacker’s app.

Google Cloud DNS + Cloud Storage

• **DNS Record**: `CNAME static.example.com -> c.storage.googleapis.com` with a bucket named `static-example-com`.
• **After Deletion**: Bucket is deleted. The bucket name is released.
• **Takeover**: Attacker creates a new bucket with the same name and makes it publicly readable.
• **Result**: Any object requested from `static.example.com` is served from the attacker’s bucket.

---

Why 2026 Is the Perfect Storm for Ghost Resource Exploitation

Three converging trends make this attack vector more dangerous than ever:

1. Ephemeral Infrastructure – Kubernetes pods, serverless functions, and CI/CD pipelines create and destroy resources rapidly. DNS cleanup is rarely automated.

2. Multi-Cloud Complexity – Organizations use 3–5 cloud providers on average. DNS records are managed in different consoles, and no single pane of glass exists.

3. Attacker Automation – Tools like `SubOver`, `CanaryTokens`, and custom scripts now scan millions of domains per hour. The barrier to entry is near zero.

---

How to Hunt Down and Eliminate Ghost Resources: An Actionable Checklist

Use this checklist to audit your environment and prevent exploitation.

Phase 1: Discovery

• [ ] Export all DNS records from your provider(s) – Route53, Cloudflare, Azure DNS, Google Cloud DNS, etc.
• [ ] Cross-reference each CNAME, A, and AAAA record against current cloud resources.
• [ ] Use automated scanners like `dnsrecon`, `Amass`, or commercial tools (e.g., Detectify, HackerOne) to find dangling records.
• [ ] Check Certificate Transparency logs for subdomains that no longer resolve.
• [ ] Review old Terraform/CloudFormation state files for resources that may have been deleted outside of IaC.

Phase 2: Verification

• [ ] For each candidate ghost, attempt to claim the resource (in a non-production test environment if possible).
• [ ] Use cloud provider APIs to check resource availability: `aws s3api head-bucket`, `az webapp show`, `gcloud storage buckets describe`.
• [ ] Monitor HTTP response codes – a 404 on a resource that should exist is a red flag.

Phase 3: Remediation

• [ ] **Immediately delete** the dangling DNS record. Do not leave it pointing to a placeholder.
• [ ] If the resource must be recreated (e.g., for migration), use a different name or IP.
• [ ] For critical subdomains, implement **DNS validation tokens** (e.g., TXT records) that must match before a new resource is accepted.
• [ ] Use **cloud provider native tools**:
• AWS: AWS Config rule `dangling-dns-check`
• Azure: Azure Policy with `AppServiceDomainValidation`
• GCP: Cloud Asset Inventory with custom alerts

Phase 4: Prevention

• [ ] Implement **Infrastructure as Code (IaC)** with lifecycle hooks that remove DNS records when resources are destroyed (e.g., Terraform `destroy` provisioners).
• [ ] Set **short TTLs** (60–300 seconds) on DNS records for ephemeral resources.
• [ ] Use **DNS monitoring services** that alert on resolution failures.
• [ ] Conduct **quarterly cloud hygiene audits** with a focus on DNS.
• [ ] Partner with a remediation specialist like **ZoeSquad** for continuous scanning and cleanup. ZoeSquad’s automated pipeline integrates with major DNS and cloud providers to detect and remove ghost resources within minutes.

---

FAQ: Expired Cloud Resources and DNS Hijacking

Q1: Can an attacker take over a subdomain even if the root domain is secure?

Yes. Subdomain takeover does not require compromising the root domain’s DNS settings. The attacker only needs control of the resource pointed to by the subdomain’s CNAME or A record. This is why even well-secured organizations with strong DNSSEC and registrar locks remain vulnerable.

Q2: How quickly can an attacker claim a deleted cloud resource?

In most cases, the resource becomes available immediately after deletion. Attackers often run continuous scans (every few minutes) and can claim a bucket or app service within seconds. DNS caching may delay the impact, but the takeover window is extremely short.

Q3: Does using a CDN or reverse proxy protect against this?

Not inherently. If your CDN (e.g., Cloudflare, Akamai) is configured with an origin that points to a cloud resource, and that resource is deleted, the CDN will still serve cached content until the TTL expires. Once the cache clears, the CDN will forward requests to a now-unclaimed origin, which an attacker can seize. You must also remove the CDN configuration when the origin is decommissioned.

Q4: Are there any legal or compliance implications?

Yes. Under GDPR, CCPA, and HIPAA, failure to secure DNS records that lead to data exposure can be considered a breach of “appropriate technical and organizational measures.” Several 2025 enforcement actions included fines for organizations that failed to remove dangling DNS records after decommissioning cloud resources.

Q5: What is the first thing I should do today to mitigate this risk?

Run a comprehensive DNS audit. Export all records and compare them against your current cloud inventory. Any record pointing to a resource that no longer exists should be deleted immediately. Then, implement automated monitoring—consider using a service like ZoeSquad that can continuously scan for ghosts and alert your team in real time.

Q6: Can this attack be used to compromise the parent domain?

Indirectly, yes. If an attacker takes over a subdomain (e.g., `cdn.example.com`), they can serve malicious JavaScript that executes in the context of `example.com` (if CSP is misconfigured). This can lead to session hijacking, data exfiltration, and even account takeover. In severe cases, attackers have used subdomain takeover to perform DNS rebinding attacks against internal services.

---

Conclusion: The DNS Ghost Is Not a Myth

In 2026, the line between cloud infrastructure and public-facing DNS is thinner than ever. Every deleted bucket, every retired load balancer, every expired app service leaves a trace in the DNS. Attackers have turned that trace into a weapon.

The cost of ignoring ghost resources is no longer theoretical. We’ve seen brand damage, regulatory fines, and massive data breaches—all preventable with proper hygiene. The solution is not complex, but it requires discipline: automate your DNS lifecycle, audit regularly, and partner with experts who can close the gaps you miss.

ZoeSquad offers proactive cloud security remediation that includes continuous DNS monitoring, automated ghost resource detection, and integration with your existing cloud and DNS providers. Their team of certified cloud architects and security engineers has helped organizations reduce their attack surface by over 80% in the first month alone.

Don’t let your DNS become a graveyard. Audit today, clean up tomorrow, and stay ahead of the ghosts.

---

*BizVuln.com is your trusted source for cloud security intelligence. For more deep-dives, threat reports, and remediation guides, subscribe to our newsletter.*