Loading story…
The TDSS malware family developed from the early TDL-1 variant into increasingly advanced rootkits that hid files, registry keys, ports, and injected modules while strengthening persistence and anti-analysis capabilities. Later versions infected kernel components and critical disk drivers such as atapi.sys, with some payloads stored as encrypted data in the final sectors of the disk, allowing the malware to survive detection and maintain deep control over compromised systems.
Researchers reported that TDSS also operated as a commercialized botnet platform, using affiliate distribution models, partner IDs, and pay-per-install schemes to spread through fake codecs, key generators, drive-by downloads, and other botnets. Its infrastructure communicated with command-and-control servers over HTTPS with RC4- and BASE64-protected requests, and its common payload, tdlcmd.dll, enabled command execution, download-and-execute activity, click fraud, search-result manipulation, blackhat SEO, and browser traffic redirection; at its height, the botnet was estimated to control roughly 3 million infected machines, with many victims in the United States.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
By the time of the 2020 Securelist publication, researchers had documented TDSS command-and-control communications over HTTPS with RC4- and BASE64-protected requests, infrastructure in multiple countries, and payloads supporting command execution, download-and-execute, click fraud, search manipulation, SEO abuse, and browser traffic redirection.
In 2009–2010, TDSS advanced to TDL-3, which infected critical disk drivers such as atapi.sys and stored encrypted components in the last sectors of the disk. This significantly improved its resistance to detection and removal.
The first known TDSS/TDL variant, later referred to as TDL-1, emerged in 2008. It used kernel-level stealth techniques to hide files, registry keys, ports, and injected modules on infected Windows systems.
During 2009, TDSS evolved into TDL-2, adding more advanced persistence and stealth by infecting system drivers and deepening its kernel-level hooks. The malware continued spreading through fake codecs, key generators, drive-by downloads, and other botnets.
By 2009, TDSS had developed beyond a rootkit into a commercialized botnet operation distributed through affiliate programs and pay-per-install schemes. Researchers estimated it controlled about 3 million infected machines in 2009, roughly half of them in the United States.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that **TDL-4**, an advanced evolution of the TDSS malware family, combined **bootkit** persistence, a powerful **rootkit**, and custom-encrypted **HTTPS** communications to create one of the most resilient malware platforms of its time. The malware hid itself and other payloads, removed competing malware from infected systems, and blocked rival botnet infrastructure, while also supporting monetization through proxy services, search-result manipulation, and advertising fraud. Kaspersky’s analysis of backend databases indicated that **4,524,488 computers** were infected in the first three months of 2011, with nearly one-third of victims located in the United States. A key innovation was TDL-4’s use of the public **Kad** peer-to-peer network through the `kad.dll` module, allowing operators to distribute commands and maintain control even if traditional command-and-control servers were taken down. Additional components such as `Socks.dll` enabled proxy functionality and `cmd64.dll` added 64-bit support, extending the botnet’s reach and durability. Researchers said the architecture was designed to make the botnet effectively **indestructible**, underscoring how TDL-4 raised the bar for stealth, survivability, and criminal monetization in large-scale malware operations.
Jun 29, 2026
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026
DarkGate has emerged as a versatile **malware-as-a-service** loader and remote access trojan used by multiple threat actors, including **TA577**, **Ducktail**, **UNC2975**, and **UNC5085**, with campaigns delivering it through large-scale email waves, fake browser updates, VBScript loaders, MSI installers, and messaging platforms such as **Skype** and **Microsoft Teams**. Proofpoint reported one major cluster, dubbed **BattleRoyal**, using DarkGate in attacks against organizations in the United States and Canada, relying on traffic distribution systems including **404 TDS** and **Keitaro TDS** and abusing malicious `.URL` files tied to **`CVE-2023-36025`** to bypass Windows SmartScreen protections before later shifting some activity to NetSupport. Technical analyses describe DarkGate as a mature platform with broad post-compromise capabilities, including reverse shell access, **PowerShell** execution, keylogging, credential and token theft, hidden **VNC** remote control, privilege escalation, persistence, file management, and even **XMRig**-based Monero mining. Researchers said the malware continues to evolve its evasion and execution methods through custom Base64 and XOR-obfuscated configuration data, HTTP POST command-and-control, alternate ports such as `2351` and `9999`, dynamic API resolution, parent PID spoofing, APC injection via **`NtTestAlert`**, DLL side-loading, AutoIt-based execution, and LOLBAS abuse through **`extexport.exe`**, underscoring DarkGate’s ongoing role as a significant cybercrime threat.
Aug 15, 2026