Report Links Los Pollos and RichAds to Malware Traffic Operations

New research by Infoblox Threat Intel exposes a hidden alliance between major cybercrime groups like VexTrio and seemingly legitimate AdTech firms such as Los Pollos, Partners House, BroPush, and RichAds. Discover how malware, including DollyWay, shifted operations, revealing shared infrastructure and tactics.

Infoblox Threat Intel has exposed a secret alliance between two cybercrime groups, VexTrio and seemingly legitimate AdTech companies. This discovery came after disrupting VexTrio, causing many malware groups to shift to a single, previously hidden provider.

The investigation began by disrupting VexTrio’s Traffic Distribution System (TDS). A TDS acts like a digital traffic controller, directing website visitors to the content. However, a malicious TDS sends users to harmful sites with malware or scams, often by “cloaking” or hiding its true nature. When VexTrio’s TDS was disturbed, malware actors unexpectedly moved to what appeared to be a new TDS, but it was the same one.

On November ...