Vacant Viper

Vacant Viper is a cybercriminal threat actor associated with the 404TDS traffic distribution system and known for large-scale exploitation of the Sitting Ducks domain-hijacking technique since at least December 2019. The actor has been assessed as part of a broader Russian-nexus cybercriminal ecosystem and has reportedly hijacked thousands of domains over multiple years to support malicious infrastructure. Vacant Viper uses hijacked domains to augment 404TDS operations, route malicious traffic, conduct spam campaigns, establish command-and-control infrastructure for remote access trojans, and deliver malware including AsyncRAT and DarkGate. Reporting also links 404TDS activity to delivery of IcedID and other malware. The actor has been described as targeting high-reputation hijacked domains to reduce blocking and improve delivery success. Operationally, Vacant Viper is notable for abusing stolen or hijacked domains rather than relying solely on newly registered infrastructure. Its use of Sitting Ducks enabled domain takeover without compromising the legitimate owner’s registrar account, allowing the actor to repurpose trusted domains for malware delivery, redirection, and other post-compromise infrastructure functions. Vacant Viper has also been linked to malicious spam operations and to infrastructure used for RAT command-and-control. Known aliases are limited to Vacant Viper. The actor has been noted as affiliated with TA571 in reporting on malware delivery ecosystems. Overall, Vacant Viper is best characterized as a financially motivated cybercriminal operator specializing in traffic distribution, malware delivery, and abuse of hijacked domain infrastructure.