Help TDS Campaigns Use Hotejka and Cloudflare Pages for Traffic Redirection

Summary

Hotejka is a Russian-language affiliate program operating a Help Traffic Distribution System (TDS) to distribute tech support scams. The operation relies on large numbers of disposable Cloudflare Pages domains to host scareware content and redirect victims toward malicious call centers. After establishing contact, attackers use social engineering to persuade victims to install remote desktop tools such as UltraViewer, enabling unauthorized system access.

Investigation

Researchers linked Hotejka to a rebranded ROI777 operation through analysis of historical DNS records, affiliate promotion patterns, and recurring C2 mechanisms. The investigation uncovered extensive use of Domain Generation Algorithms (DGA) to create thousands of Cloudflare Pages subdomains. Analysts were able to reverse-engineer these DGAs and predict malicious domains roughly seven days before they became operational.

Mitigation

Organizations should deploy predictive DNS security controls to block newly created or algorithmically generated domains associated with known TDS patterns. Monitoring for unauthorized installation of remote desktop software, including UltraViewer, is also critical. Security teams should additionally watch for suspicious DNS CNAME redirects and unauthorized modifications to WordPress plugins.

Response

When indicators are detected, organizations should immediately block identified domains and IP addresses at DNS and firewall layers. Perform host-level investigations for unauthorized remote access tools and inspect systems for suspicious browser extensions or malicious plugins. Review web logs for traffic patterns associated with the Hotejka DGA and unusual CNAME redirection chains.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to facilitate a tech support scam by redirecting victims through a Traffic Distribution System (TDS). To evade traditional reputation-based filters, the adversary hosts the TDS on Cloudflare Pages. The simulation involves an internal “infected” host making an outbound request to one of the known malicious subdomains: linen-thorn-wild.pages.dev. This action simulates the moment a user is redirected to the TDS, generating the exact domain telemetry the rule is designed to catch.

• Regression Test Script: This script uses curl to simulate an outbound connection to the malicious domain, ensuring the request appears as an outbound network event in the proxy logs.

  #!/bin/bash
  # Simulation of outbound connection to Hotejka's Help TDS domain
  
  TARGET_DOMAIN="linen-thorn-wild.pages.dev"
  
  echo "[+] Starting simulation: Connecting to $TARGET_DOMAIN"
  
  # Using curl to trigger an outbound GET request
  # -s: silent, -L: follow redirects (simulating TDS behavior), -I: fetch headers only
  curl -sL -I "https://$TARGET_DOMAIN"
  
  if [ $? -eq 0 ]; then
    echo "[+] Simulation command executed successfully."
  else
    echo "[!] Simulation command failed. Check connectivity."
  fi

• Cleanup Commands:

  # No cleanup required as this was a read-only network request simulation.
  echo "[+] Simulation cleanup complete."