{"id":14290,"date":"2026-10-15T06:00:02","date_gmt":"2026-10-15T13:00:02","guid":{"rendered":"https:\/\/www.infoblox.com\/blog\/?p=14290"},"modified":"2026-10-15T09:30:42","modified_gmt":"2026-10-15T16:30:42","slug":"inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection\/","title":{"rendered":"Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection"},"content":{"rendered":"

Threat research is always a bit of a cat-and-mouse game, and it\u2019s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They\u2019ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools. It\u2019s not simple credit card fraud: it\u2019s remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again.<\/p>\n

<\/p>\n

This is exactly the kind of case that gets under our skin.<\/p>\n

Over the last year we\u2019ve researched the identity of this actor and learned more about how their operations work. It turns out, they weren\u2019t hiding at all.<\/p>\n

We assess that Hotejka, a small Russian-language affiliate program, operates the TDS. Hotejka appears to be a rebrand of ROI777, an entity exposed in 2018 for similar activities. Their affiliates range from spam operators to website compromisers. Potential victims are redirected into the TDS from these affiliates via special URLs provided by Hotejka. The TDS then evaluates the user via browser fingerprinting and location to determine the course of action.<\/p>\n

The device of their intended victims<\/strong><\/a> first displays a notice that an update is required and that their PC will restart. From there, regardless of what they choose to do, warnings that the machine has been disabled by Microsoft cover the screen. To further scare the device owner, Hotejka uses a \u201cbrowser lock\u201d that is difficult to escape and gives the sense that the machine is no longer operable. Alarms blare and a \u201cMicrosoft Security\u201d phone number appears on the screen. A computerized voice track tells the user not to attempt to restart the computer, and that the computer lock is designed to stop illegal activity. It is jarring and compelling. See embedded video in Figure 1.<\/p>\n

<\/p>\n

\n