Full Report
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting
Analysis Summary
# Tool/Technique: Help TDS (Traffic Distribution System)
## Overview
Help TDS is a long-running Traffic Distribution System used to facilitate traffic monetization fraud and tech support scams (TSS). Operated by a Russian-language affiliate program called **Hotejka** (a rebrand of **ROI777**), it serves as a routing infrastructure that intercepts web traffic and dynamically directs victims to malicious destinations based on browser fingerprinting and geolocation.
## Technical Details
- **Type:** Traffic Distribution System (TDS) / Framework
- **Platform:** Web-based (PHP, WordPress, CMS platforms, Cloudflare Pages)
- **Capabilities:** Traffic filtering, browser fingerprinting, credential theft, redirection, and browser locking.
- **First Seen:** Approximately 2017 (under precursors like Disposable TDS and ROI777).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- [T1190 - Exploit Public-Facing Application] (Vulnerable CMS/WordPress)
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Web Browsers] (via "woocommerce_inputs" plugin)
- **[TA0007 - Discovery]**
- [T1202 - Indirect Command Execution]
- [T1082 - System Information Discovery] (Browser fingerprinting)
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- **[TA0040 - Impact]**
- [T1499.004 - Endpoint Denial of Service: Application Exhaustion] (Browser lockers)
## Functionality
### Core Capabilities
- **Traffic Interception:** Collects traffic from compromised websites, malicious ads, social media, and SEO spam.
- **Filtering and Targeting:** Evaluates visitors based on geographic location, device metadata, IP reputation, and the detection of headless browsers (anti-bot) to determine the next payload.
- **Malicious Redirection:** Directs filtered users to tech support scams, browser lockers, or malware drops.
- **WordPress Exploitation:** Utilizes malicious plugins (e.g., `woocommerce_inputs`) to steal administrative credentials and inject redirection code.
### Advanced Features
- **Affiliate Infrastructure:** Provides PHP code templates and custom HTML blocks to partners for installation on compromised sites.
- **Browser Manipulation:** Employs full-screen manipulation and exit prevention (browser locking) to display fake Windows security alerts.
- **Evasion:** Likely implemented on the Keitaro TDS platform to manage complex campaign rules and evade simple signature detection.
## Indicators of Compromise
- **File Names:**
- `woocommerce_inputs` (Malicious WordPress plugin)
- `r2r2` (Malware associated with the Prowli/ROI777 era)
- **Network Indicators:**
- `roi777[.]com` (Historical C2)
- `hotejka[.]com` (Affiliate program domain)
- 20,000+ domains hosted on Cloudflare Pages (used for tech support scams)
- **Behavioral Indicators:**
- Unexpected PHP file modifications on WordPress/CMS installations.
- Outbound connections from web servers to known TDS infrastructure for URL fetching.
- Forced full-screen browser behavior on legitimate sites.
## Associated Threat Actors
- **Hotejka:** The primary Russian-language affiliate program.
- **ROI777 / Disposable TDS:** Predecessor groups/tools.
- **VexTrio Viper:** A high-level cybercrime broker that Help TDS hands traffic off to.
- **Prowli Attackers:** Operators involved in traffic manipulation and crypto-mining.
## Detection Methods
- **Signature-based:** Detection of the `woocommerce_inputs` plugin or specific PHP redirect templates.
- **Behavioral:** Monitoring for unauthorized CMS credential usage followed by file modifications or injections.
- **Predictive Detection:** Identifying malicious patterns in domain registration (e.g., bulk Cloudflare Pages domain creation).
## Mitigation Strategies
- **CMS Hardening:** Keep WordPress and all plugins updated; remove unused or suspicious plugins immediately.
- **Credential Hygiene:** Implement Multi-Factor Authentication (MFA) for all CMS administrative accounts.
- **Web Application Firewalls (WAF):** Deploy WAFs to block known TDS redirect patterns and malicious C2 communication.
- **User Education:** Train users to recognize the signs of tech support scams (e.g., browser locks and "Microsoft" phone numbers).
## Related Tools/Techniques
- **Keitaro TDS:** The underlying legitimate platform often abused by this TDS.
- **Operation Prowli:** The historical campaign associated with the ROI777 era.
- **ShadowCaptcha:** A related technique/tool used to exploit WordPress sites.