Researchers Expose Help TDS Tech Support Scam Operation
Summary
Infoblox investigated Help TDS, a traffic-routing platform linked to Microsoft-themed tech support scams, and found an affiliate network, rapidly rotating C2 domains, and thousands of Cloudflare Pages sites used in the operation.
Key points
- Infoblox says Help TDS has operated since 2017 and routes victims to tech support scams through more than a dozen affiliates, including operators associated with Balada Injector and DollyWay.
- Researchers accessed Help TDS’s affiliate panel and linked the platform to Hotejka, a Russian-language advertising affiliate network.
- The scam uses fake Windows alerts to pressure victims into calling a fraudulent support number and installing remote-access software; a researcher’s call was directed to ultraviewer[.]net.
- Infoblox reported that Help TDS changes its C2 domain sets every five minutes and uses domain-generation algorithms to create about 300 new Cloudflare Pages sites daily.
- The researchers detected more than 20,000 such domains over six months and said they can identify new sites about seven days before Help TDS uses them.
- Infoblox reported domains and technical samples to Cloudflare, which is reviewing them; researchers could not confirm whether the Keitaro server is running supported software or an older or cracked version.
Article Details
- Attack Vectors
- Help TDS routes traffic from compromised WordPress sites, malvertising, social media, and spam to Microsoft-themed tech support scam pages.
- The scam displays fake Windows update and security alerts that pressure users to call a support number; call-center operators then urge victims to install a remote desktop application.
- Help TDS fingerprints prospective victims and redirects them to the scam or another affiliate platform; its operators rapidly rotate C2 domain sets.
- Defensive Notes
- Infoblox reverse-engineered Hotejka's domain-generation algorithms and reports detecting new Cloudflare Pages sites about seven days before Help TDS uses them.
- Infoblox reported some recent domains and technical samples to Cloudflare, which was reviewing them.
- The article identifies the operator's use of rapidly rotating C2 domains and disposable Cloudflare Pages sites as challenges for tracking and blocking the operation.
People
Threat Actors
Balada InjectorIdentified by Infoblox as a malware operation among the affiliates associated with Help TDS.DollyWayIdentified by Infoblox as a malware operation among the affiliates associated with Help TDS; the article describes a DollyWay operator routing hijacked WordPress traffic through Help TDS.
Vendors
CloudflareHelp TDS Runs on Cloudflare and KeitaroInfobloxIn a recent report, Infoblox detailed Help TDS [traffic distribution system], a malicious tool used by cybercriminals since 2017 to redirect Web traffic to their desired destinations. TDSes were originally designed asKeitaroHelp TDS Runs on Cloudflare and Keitaro
Products
Cloudflare PagesA key component of the Help TDS scam operation is its abuse of "free, disposable" Cloudflare Pages sites for infrastructure since April, according to Infoblox. And the volume has been significant.Help TDSIn a recent report, Infoblox detailed Help TDS [traffic distribution system], a malicious tool used by cybercriminals since 2017 to redirect Web traffic to their desired destinations. TDSes were originally designed asKeitaroHelp TDS Runs on Cloudflare and Keitaro