Infoblox infiltrates long-running Microsoft tech-support scam
Original title: Researchers Infiltrate Microsoft Tech Support Scam Operation
Help TDS, used since 2017, routes victims to fake alerts and remote-access installs.
Infoblox researchers gained access to the affiliate panel of Help TDS, a malicious traffic distribution system used since 2017 to send web users to a tech-support scam impersonating Microsoft. Victims see fake security alerts and are pushed to call a center run by the attackers, who try to get remote desktop tools installed for repeated access. Infoblox says a Russian organization runs the TDS and the operation abuses thousands of Cloudflare links. The published excerpt cuts off during the technical description.
Unconfirmed: The article excerpt ends before Infoblox’s full findings on the affiliate panel and origin.
- Help TDS filters traffic and can avoid antimalware systems and sandboxes.
- Infoblox describes the goal as remote access rather than simple card fraud.
- The operation has used the TDS since 2017.
- Researchers obtained direct access to the platform’s affiliate panel.
Impact: Remote access to victim systems through installed desktop tools
- Vendors
- MicrosoftCloudflare
- Malware
- Help TDS
- Organizations
- Infoblox
- Countries
- Russia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ultraviewer.net | in. He then advised her to open the Start window and go to ultraviewer[.]net, the home page for a free remote desktop application for |
| md5 | 2dfc59743329df8d3d7e339c546d9d6a | -mois-training-academy#recipe=similar-items&sourcecontentid=2dfc59743329df8d3d7e339c546d9d6a) Data Leak Outs Hacker Students of Iran's MOIS Training Ac |
| md5 | cee51c1e132a09f4d2269704d631b3dd | y-firm-outpost24-phish#recipe=similar-items&sourcecontentid=cee51c1e132a09f4d2269704d631b3dd) Hackers Target Cybersecurity Firm Outpost24 in 7-Stage Ph |
| md5 | f52c49aa13e56917581cde296474faa3 | ernet-attacks-continue#recipe=similar-items&sourcecontentid=f52c49aa13e56917581cde296474faa3) React2Shell Exploits Flood the Internet as Attacks Contin |
| md5 | f77e926bb76465f465f24e5fc7e9eebc | r-kinetic-war-doctrine#recipe=similar-items&sourcecontentid=f77e926bb76465f465f24e5fc7e9eebc) Iran's Cyber-Kinetic War Doctrine Takes Shape by Alexande |
From the original article
10 min read at darkreading.com
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
By Rob Wright · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.