Loading malware…
404TDS is a homegrown malicious traffic distribution system (TDS) operated by the threat actor Vacant Viper. According to the provided content, Vacant Viper uses hijacked domains obtained through the 'Sitting Ducks' DNS hijacking technique to augment 404TDS infrastructure and route malicious traffic. The system has been used since at least December 2019 in malicious spam operations, porn delivery, establishment of remote access trojan (RAT) command-and-control infrastructure, and malware delivery. Reported payloads delivered via 404TDS include DarkGate and AsyncRAT, and the actor is also described as delivering numerous RATs through this infrastructure. The content further states that Vacant Viper preferentially targets hijacked domains with high reputations to reduce the likelihood of security vendor blocking. No specific file-based indicators or hashes are provided in the source content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
404TDS is a traffic distribution system (TDS) used by threat actors to deliver various remote access trojans (RATs) by hijacking domain names. It is part of the malicious adtech ecosystem that enables the distribution of malware while evading detection.
404TDS is a malicious traffic distribution system used by threat actors to route and manage malicious web traffic, facilitate spam, deliver malware payloads, and establish C2 infrastructure for RATs.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.