Russian Hackers Run Record-Breaking Online Ad-Fraud Operation

Methbot is a sophisticated cybercrime scheme that has hit major US advertisers and publishing brands and pilfered millions of dollars per day.

[UPDATED 12/21 with response from digital ad industrys Trusted Accountability Group (TAG)]
Cybercriminals out of Russia are behind a newly discovered massive online advertising fraud operation hiding in plain site that steals up to $5 million per day from big-name US advertisers by posing as some 6,000 major US media sites including The Huffington Post, Fortune, ESPN, CBS Sports, and Fox News, and generating fake ad impressions.
Researchers at White Ops recently spotted the so-called Methbot operation pilfering anywhere from $3 million to $5 million per day in what they say is the largest and most profitable online ad fraud operation in history. Methbot has been operating for three years under cover by a Russian cybercrime group that White Ops has dubbed AFK14, with a unique twist: its own internal botnet infrastructure runs and automates the click-fraud rather than the traditional ad fraud model of infecting unsuspecting consumers to do the dirty work.
US advertisers in October alone lost a whopping $17.7 million to the criminal hackers, according to White Ops, and AFK13 made some $10.6 million.
AFK13, which is based in Russia, also employs data centers in Dallas and Amsterdam, to run its botnet via spoofed IP addresses that help them evade blacklists. The cybercrime gang created its own Web browser in order to better hide its tracks, as well as its own HTTP library.
This is the largest operation ever discovered in digital ad fraud, says Eddie Schwartz, president and COO of White Ops, an ad fraud detection firm, which published its findings on AFK13 and its Methbot infrastructure today. This one is unique in that they went to the trouble of writing their own browser code … They game everything across the entire value chain of online advertising, he says.
The Methbot network basically drives video and other ad impressions that appear to be humans clicking on them. But video ad watching is actually via its botnet of automated Web browsers of more than a half-million Internet addresses using phony IP registrations posing as large ISPs such as Verizon, Comcast, AT&T, Cox, and CenturyLink.
The botnet generates phony impressions for up to 300 million of these ads daily and sends them via 6,111 Internet domains posing as actual ad inventory on brand-name websites, according to White Ops.
Ad companies are losing because theyre paying the bill for phony impressions, White Ops Schwartz says.
Methbot until recently was able to operate under the radar because the Russian cybergang behind it has apparently studied how to avoid detection, including reverse-engineering and duping ad-fraud measures and spoofing fraud verification data so the advertiser sees Methbots ad impressions as legit, even though theyre phony.
AFK13s Methbot has tallied some 200 million to 300 million phony video-ad impressions daily, making an average of $13.04 per CPM, or around $4 million in phony ad inventory revenue each day.
The Russian hackers even have built the bots to imitate mouse movements and social media login information so they appear to be human-generated activity. Theyre making the traffic look like residential humans, Schwartz says.
He says the forged and compromised domains made them appear legit to the advertising exchange services that broker ad space inventory for publishers. The exchanges were fooled into believing they were handing the subsequent ad impressions to the publishers, but that phony yet billable traffic instead went to Methbot.
Methbot Bust
But the fraudulent ad operation ended up exposing itself, thanks to a bug in its homegrown HTTP library. They used a custom HTTP library that was very buggy and set off a bunch of alerts on our system, says White Ops principal researcher Ryan Castellucci, who is credited with first discovering Methbot. The buggy library was part of why we noticed that they had started ramping up their traffic, they say.
White Ops declined to identify which advertisers have been victimized by Methbot, but they say its a whos who in online advertising. The company has been working with law enforcement to unmask the operation.
Mike Zaneis, CEO of the digital advertising industrys Tustworthy Accountability Group (TAG), applauded White Ops findings. This massive fraud operation represents a significant threat to the integrity of the ecosystem, and it shows why TAGs work is so vital in bringing the digital advertising industry together to share information, adopt rigorous standards, validate best practices, and increase transparency, Zaneis said in a statement.
Within 24 hours of our notification by White Ops, TAG was able to alert 130 fraud compliance officers at the largest and most influential digital advertising companies and bring the vast majority of those anti-fraud leaders together to learn details of the attack and determine the appropriate action for their companies to take, he said.
Heres how big Methbot stacks up to previous click-fraud campaigns money-wise: ZeroAccess took in about $900,000 per day; the Chameleon botnet, up to $200,000 per day; and HummingBad, up to $10,000 per day, according to
White Ops report
.
Related Content:
Bots Will Inflict $7.2 Billion In Fraud On Digital Advertisers In 2016
Online Ad Fraud Exposed: Advertisers Losing $6.3 Billion To $10 Billion Per Year
5 Ways The Cyber-Threat Landscape Shifted In 2016
The 7 Most Sensational Breaches Of 2016

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Russian Hackers Run Record-Breaking Online Ad-Fraud Operation