Researchers Infiltrate Microsoft Tech Support Scam Operation

A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.

Tech support scams seem like a dime a dozen these days, but researchers got an inside look at one long-running operation to see how cybercriminals are using legitimate tools and infrastructure to masquerade as Microsoft IT personnel.

In a recent report, Infoblox detailed Help TDS [traffic distribution system], a malicious tool used by cybercriminals since 2017 to redirect Web traffic to their desired destinations. TDSes were originally designed as traffic management tools for digital advertising partners, known as affiliates, to filter Web traffic and redirect specific users to ads based on different criteria, such as region, operating system, device, and others.

But over the past decade-plus, a wide variety of threat actors have abused commercial TDS platforms, and even developed their own underground versions marketed on the Dark Web. The tools are used by cybercriminals in malvertising campaigns, ransomware attacks, and other threats to re-route unsuspecting Web users to malicious destinations while also filtering out systems with antimalware protection and sandboxes, for example.

In the case of Help TDS, victims are redirected to a tech support scam operation that, like many others, deploys fake security alerts to scare users into calling a support number. But threat actors operate the call center, not Microsoft employees, and their goal is to convince victims to install remote desktop tools on their systems.

“It’s not simple credit card fraud: it’s remote access, living-off-the-land malware operations,” Infoblox researchers wrote. “Once in, the threat actor can exploit the victim time and again.”

While investigating Help TDS, Infoblox researchers obtained direct access to the platform’s affiliate panel, which not only provided clues to its origin but also illustrated how these Microsoft-focused tech support scams operate.

Inside the Help TDS Tech Support Scam

According to Infoblox, Help TDS acts as the routing decision infrastructure for more than a dozen affiliates — except the affiliates are scam operations and cybercriminal groups rather than legitimate advertising partners. In the case of Help TDS, some of these affiliates are well-known threats, such as the Balada Injector and DollyWay malware operations.

Infoblox researchers investigated Help TDS over the past year and determined the platform is operated by Hotejka, a Russian-language advertising affiliate network. Infoblox declined to say how it achieved access to the affiliate panel, to prevent Help TDS from removing that access, but provided Dark Reading with additional screenshots and evidence not contained in the company’s published report. The screenshots of the Hotejka affiliate panel show many of the familiar features of panels from other advertising networks, such as smartlinks and referral offers, campaign demonstrations, and tracking dashboards.

Hotejka’s affiliate panel includes direct links to tech support scam campaigns. Source: Infoblox

But the researchers also found that the panel contained direct links to the Microsoft-themed tech support scam and a malicious WordPress plug-in previously documented by GoDaddy researchers. In short, any “affiliate” of Hotejka could select the tech support scam as a campaign to run, or select “mainstream” smartlinks as a typical advertising partner might choose.

When a threat actor, such as a DollyWay operator, selects the tech support scam as the destination for its hijacked WordPress traffic, for example, unsuspecting users are filtered through the Help TDS. Each prospective victim is fingerprinted and rerouted to either the tech support scam or another affiliate platform for further monetization.

When the tech support scam is initiated, a user’s PC is hit with a Windows notification for a required update, which will restart their system. Regardless of whether the user chooses to restart immediately or later, the screen flashes and displays another Windows error message, followed by a fake warning from Microsoft Windows Security Center stating that the user’s access to device has been blocked, with voice-over instructions urging users not to restart their systems to call a listed telephone number to reach Microsoft technical support staff.

Call Center Shenanigans

Infoblox’s investigation went a step further than just identifying the technical aspects of the Help TDS operation. Renée Burton, vice president of threat intel at Infoblox, called one of the phone numbers listed in the scam Windows security alert and was routed to an individual who claimed to be a Microsoft technical support employee, working in what sound like a busy call center.

Infoblox recorded and published the conversation, during which the threat actor repeatedly assured Burton that she would not be charged for the support. After asking her several questions, the phony support employee directed her to use ctrl-alt-delete to log out of the Windows system and then log back in. He then advised her to open the Start window and go to ultraviewer[.]net, the home page for a free remote desktop application for PCs.

Burton was put on hold several times during the 13-minute call, which researchers believe was to done for the threat actors to perform additional screening and profiling. The call end abruptly after she questioned the need to download the remote access tool; Burton said it’s not clear if there was an accidental disconnection or if the phony support employee got suspicious and ended the call.

“They are pretty good about controlling the call centers,” she says, adding that Infoblox hasn’t yet re-established contact with the scam operation. “You have to call during certain hours, and they check the IPs and devices.”

Burton says the Help TDS operation has three things that distinguish it from other tech support scams. First, the browser lock component is very effective and completely disables keyboard access, while the voice-over instructions provides “a huge social engineering component to it.”

Second, the Help TDS Telegram channel is used for command-and-control (C2) rollovers, rapidly changing C2 domain sets every five minutes over the past six months, according to the report. “I think it’s very effective in keeping their systems up,” Burton says, as it makes tracking and blocking malicious activity much harder.

And lastly, Burton says the Help TDS affiliate model is unique and gives the tech support scam substantial scale. “These guys have the affiliates that are all the big names in the website malware industry,” she says.

Help TDS Runs on Cloudflare and Keitaro

A key component of the Help TDS scam operation is its abuse of “free, disposable” Cloudflare Pages sites for infrastructure since April, according to Infoblox. And the volume has been significant.

“The threat actor creates hundreds of new pages a day. We detected over 20,000 such domains in a six-month period,” the report stated. “Another 10,000 pages were created in what appear to be additional phishing or decoy operations.”

Infoblox researchers noted that Hotejka uses several different domain generation algorithms to create approximately 300 new Cloudlfare Pages sites a day. Infoblox noted that when Help TDS migrated to Cloudflare Pages earlier this year, the company saw up to 4% of its cloud customers exposed to Help TDS on a single day. “While these numbers might not seem large, it shows that Help TDS, often through affiliates who compromise websites, but also through malvertising, social media, and spam distribution, can reach a wide range of organizations,” the report stated.

And while Infoblox researchers reverse-engineered the algorithms and can now detect Hotejka’s new Cloudflare Pages sites about seven days before they’re used by Help TDS, there are still significant challenges for tracking and documenting the abuse. “The C2 rolls over so fast, and there’s a new C2 every five minutes. And It seems to be [using] a lot of Cloudflare accounts,” Burton says, adding that the “crazy variety” of abused Cloudflare accounts isn’t typical of similar campaigns, which typically one use one or two.

Another challenging aspect is that Help TDS is still running on the same Keitaro server that it was initially deployed on nearly a decade ago, according to Infoblox. Keitaro is a commercial TDS firm whose platform has been frequently abused by threat actors, leading to questions about its security and misuse prevention efforts.

While Keitaro and parent company Apliteni earlier this year cooperated with researchers at Infoblox to disrupt abuse of their platform, it’s unclear if the Keitaro server is a supported version of the TDS software or a cracked or older version with no license control. Burton says she suspects it’s the latter, but because the server is behind Cloudflare services, the researchers are unable to confirm it and determine the full nature of the infrastructure.

Burton says Infoblox reported some of the recent domains to Cloudflare and provided technical samples of the operation, and that the company is reviewing them.