Loading threat actor…
Rich Audience is an advertising platform associated with publisher and advertiser traffic monetization, including display, video, rich media, and native formats. High-confidence reporting links Rich Audience to the broader VexTrio malicious traffic distribution ecosystem through shared artifacts, infrastructure, and operational overlap with other adtech and push-traffic networks. This ecosystem has been tied to large-scale redirection operations involving compromised websites, malicious push-notification schemes, fake CAPTCHA lures, and traffic brokerage supporting malware delivery and other abusive campaigns. Closely related entities in the same ecosystem include VexTrio, Help TDS, Disposable TDS, Los Pollos, Partners House, BroPush, RichAds, and RexPush. The cluster has shown a strong Russian nexus and long-running involvement in monetizing victim traffic from website compromises. Direct evidence supports Rich Audience’s association with this ecosystem, but the available information does not independently establish Rich Audience as a distinct named intrusion set or provide sufficient high-confidence detail on its own standalone operations, victimology, or internal sub-groups.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.