TDS platforms are designed for redirection of users in particular sites. Legitimate TDS platforms, such as Keitaro, are mainly used by individuals and companies that want to advertise services or their products. Platforms drive users to the pages that companies want, targeting specific customers and promoting an ad campaign.
The Keitaro platform, for example, uses more than 20 filters to accurately target users (e.g., location, device information, information for the browser and more).
However, these platforms can also be used by hackers for evil purposes.
There are, indeed, some that are specially designed for illicit purposes (e.g. EITest, Seamless, Sutra, BlackOS, NinjaTDS). These TDS platforms redirect the possible victims in exploit kits that try to infect them with malware.
"TDS platforms are a very useful tool for an attacker who wants to restrict the distribution of malicious content," said Proofpoint researchers. "An attacker using TDS can ensure that the detectors and Investigators security they see nothing malicious, but real users are redirected to exploits and malware».
Distribution of malware
Using a legitimate TDS platform has made it difficult to detect illegal activity but also to block redirects.
Keitaro was used in August to redirect users to the Fallout or RIG exploit kit where possible vulnerabilities and the geographical location of each target, and based on various other criteria.
The goal of the hackers was to redirect users: 1) to malvertising sites that infected them using one of two exploit kits, 2) on malicious files that install malware. In the end, they were even guided by law sites.
Victim systems were infected with various malicious programs, such as AZORult, Predator the Thief, CoinMiner, KPOT, SystemBC, Osiris, Chthonic, Vidar Stealer, Amadey, Danabot “40”, Vidar, Gootkit or Onliner.
The attackers who took advantage of the Keitaro TDS platform were cleverly moved to exploit a legitimate platform so their malicious activities could not be easily detected.
Researchers continue to monitor the Keitaro platform.