Vextrio

VexTrio, a large cyber threat distributor, has been identified as a significant traffic broker for cybercriminals, according to Check Point Research's January 2024 Most Wanted Malware report. The entity operates one of the most extensive HTTP-based Traffic Direction System (TDS) networks, with an infrastructure built on a network of over 70,000 hijacked websites used to distribute malicious content. This operation forms part of an emerging ecosystem of cybercrime that leverages TDS networks, where VexTrio stands out due to its size and impact. The modus operandi of VexTrio includes maintaining numerous compromised websites and affiliates, ensuring a constant flow of malicious traffic even when some clients are neutralized by cyber defenders. They employ sophisticated techniques such as injecting exposed sites with malicious JavaScript, which prompts users with fake browser update notifications. Furthermore, VexTrio's TDS servers quickly filter traffic based on information gleaned from browser settings and cached data, including the target's operating system, location, and other potentially relevant data. Notably, VexTrio has established strategic partnerships with other notable threat actors like SocGholish and ClearFake, who also run their own TDS but pass victims to VexTrio's TDS. Adding to its robust operations, VexTrio continues to register large quantities of domains daily, using a dictionary-based domain-generation algorithm. This method provides them with a ready, ever-changing supply of domains for hosting malicious content, contributing to an estimated total of at least 70,000 malicious domains under their control.