Vextrio

Vextrio, a significant threat actor in the cybercrime landscape, has been uncovered as a major traffic broker for cybercriminals by Check Point Research's January 2024 Most Wanted Malware report. The group operates Vextrio Viper, a Traffic Distribution System (TDS) network established in 2020, which links compromised domains to an affiliate network of over 65 partners. These partners redirect users to phishing, malware, and scam sites, contributing to the development of extensive cybercrime ecosystems around HTTP-based TDS networks. The Vextrio network consists of approximately 70,000 hijacked websites used for distributing malware and conducting fraud. Infoblox, a cybersecurity firm, noted that while other cybercrime groups like SocGholish and ClearFake operate their own TDS networks, they also have strategic partnerships with Vextrio, effectively passing victims to its TDS. Moreover, Vextrio continues to register large quantities of domains daily using a dictionary-based domain-generation algorithm, providing a constantly changing supply of domains for hosting malicious content. Since its inception six years ago, Vextrio has taken over multiple legitimate domains, including a hospital website in Colombia and various WordPress sites with known vulnerabilities, allowing them to reroute user traffic. According to a report from Infoblox, Vextrio maintains multiple traffic distribution systems used by over 60 affiliates, indicating the group's influence and reach within the cybercrime community. This vast network and its ongoing activities underline Vextrio's role as a central operator in the cybercrime ecosystem.