Infoblox Threat Intel

Vault Viper is a uniquely dangerous threat actor blending criminal infrastructure with advanced cyber capabilities. It distributes a custom browser disguised as privacy software, which covertly installs surveillance tools, alters DNS settings and connects to command-and-control (C2) servers.

With millions of installs and ties to transnational organized crime—including money laundering, fraud and human trafficking—Vault Viper weaponizes online gambling platforms to harvest user data, evade detection and monetize victims at scale.

Its vast DNS footprint and malware-like behavior make it a rare convergence of cybercrime and real-world criminal enterprise.

Vault Viper

• Operating since: April 2005
• Infoblox discovered: March 2025
• Infoblox published: October 2025
• Prevalence: Uncommon