Vane Viper
Vane Viper, also known as Omnatuor, is a cybercrime threat actor associated with malicious adtech, malvertising, ad fraud, and traffic distribution infrastructure. Infoblox reported that the actor has operated in this role for at least a decade and previously documented it in August 2022 as a malvertising network similar to VexTrio Viper. The actor is described as using shell companies and opaque ownership structures to evade accountability. According to the provided reporting, Vane Viper exploits vulnerable WordPress sites and leverages hundreds of thousands of compromised websites and malicious ads to redirect users to scams, exploit kits, malware, and other fraudulent destinations. Reported payloads and outcomes include riskware, spyware, adware, LummaStealer delivered behind fake CAPTCHA pages, and at least one instance involving Android malware Triada. Guardio Labs linked its DeceptionAds campaign to Vane Viper infrastructure; that campaign distributed Lumma Stealer via fake CAPTCHA verification pages and facilitated ClickFix-style social engineering. A notable technique attributed to Vane Viper is systematic abuse of browser push-notification permissions using service workers, allowing persistent ads and deceptive notifications after a user leaves the originating page. Infoblox also reported this push-notification abuse was used to serve ads and facilitate ClickFix-style social engineering campaigns. Infoblox assessed Vane Viper infrastructure at roughly 60,000 domains with rapid churn, with most domains active for less than a month, alongside some long-lived domains such as omnatuor[.]com and propeller-tracking[.]com. The actor was reported to account for about 1 trillion DNS queries over the past year across about half of Infoblox customer networks, and to have registered large numbers of new domains monthly, peaking at about 3,500 in October 2024. The reporting also states that Vane Viper appears to share infrastructure and personnel ties with URL Solutions (Pananames), Webzilla, and XBT Holdings. Infoblox further reported that URL Solutions is linked to disinformation sites associated with the Russian influence operation Doppelgänger. One cited roundup additionally described Vane Viper as linked to the Russian diaspora in Europe and Cyprus. The content does not establish Vane Viper as a nation-state actor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Systematic push notification abuse to serve ads and facilitate ClickFix-style social engineering campaigns.
Provides malicious adtech infrastructure supporting malvertising, ad fraud, and broader threat proliferation at scale (DNS-heavy infrastructure).
Vane Viper is a long-running cybercrime operation leveraging compromised websites and malvertising to distribute malware and exploit kits, with infrastructure linked to Russian diaspora in Europe and Cyprus.
Operates as (and behind) a malicious adtech/traffic distribution system enabling large-scale malvertising and ad fraud, brokering traffic for malware droppers and phishing, and sometimes running its own campaigns. Uses compromised WordPress sites and large volumes of short-lived domains to redirect victims to scams, malicious extensions, and malware.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.