Actor Profile

Hotejka is a Russian-language cybercrime affiliate program operating the Help TDS (Traffic Distribution System) since at least 2017. Assessed to be a rebrand of ROI777, a traffic monetization operation exposed in 2018 following a data leak from its servers in March 2018. The rebranding occurred after the leak exposed Telegram identities and campaign details. Hotejka's motivation centers on traffic monetization through tech support scams, generating revenue by redirecting compromised website visitors to call centers where social engineering enables persistent remote access and repeated victim exploitation. The operation partners with affiliates ranging from spam operators to website compromisers, providing them PHP code templates and specially crafted URLs to funnel traffic through their TDS infrastructure.

TTPs (Tactics, Techniques, Procedures)

Help TDS employs a multi-stage traffic distribution architecture built on the Keitaro advertising tracking platform. Initial access is achieved through compromised websites where affiliates install malicious WordPress plugins (notably "woocommerce_inputs") or custom HTML blocks that steal credentials and facilitate redirections. The TDS performs browser fingerprinting and geolocation analysis to filter and route victims based on device metadata, IP reputation, and detection of headless browsers. Victims are served full-screen browser manipulation and exit prevention techniques displaying fake Microsoft Windows security alerts. Social engineering via phone convinces victims to install legitimate remote desktop tools like Ultraviewer, enabling living-off-the-land techniques for persistent access. The operation leverages over 20,000 disposable Cloudflare Pages domains (*.pages.dev) created at approximately 300 per day since April 2026. Historical infrastructure shows traffic handoffs to VexTrio Viper affiliate network and use of roi777[.]com as C2 between 2018-2020. Alternative traffic paths lead to fake CAPTCHA checks for push-notification spam enrollment.

Targets & Patterns

Hotejka targets general internet users who visit compromised websites, with filtering mechanisms selecting victims based on geographic location, device characteristics, and behavioral indicators suggesting genuine users rather than security researchers or automated scanners. The operation demonstrates no specific sector focus, instead pursuing broad opportunistic targeting through website compromise and spam distribution channels. Victims are monetized through tech support scam call centers, with Telegram posts from July 2026 indicating operations handling 50-100 calls daily from a German call center. The targeting pattern emphasizes volume over precision, leveraging thousands of compromised WordPress sites and CMS platforms to maximize traffic flow into the TDS. Once remote access is established, victims face repeated exploitation rather than one-time fraud, suggesting a preference for high-value individual targets who can be manipulated multiple times.

Historical Context

Help TDS represents the evolution of infrastructure previously operated as Disposable TDS by ROI777 around March 2018. ROI777 was first exposed by Guardicore Labs in June 2018 during Operation Prowli, a campaign involving cryptocurrency mining via r2r2 malware and traffic monetization fraud through compromised WordPress and CMS platforms. The March 2018 data leak from ROI777 servers precipitated the rebrand to Hotejka, though operational continuity is evidenced by consistent C2 mechanisms, loyal use of affiliate advertising platforms, and historical DNS records linking roi777[.]com as a C2 domain through 2020. GoDaddy documented Help TDS evolution in August 2025, identifying the woocommerce_inputs plugin as a key compromise vector. The operation has maintained partnerships with VexTrio Viper for traffic handoffs and consistently operated within the Russian-language cybercrime ecosystem. Since April 2026, the operation shifted to mass deployment of Cloudflare Pages domains, scaling to over 20,000 active scam sites.

Defensive Recommendations

  • Monitor for unauthorized WordPress plugins, particularly those with names resembling legitimate e-commerce extensions like 'woocommerce_inputs', and implement file integrity monitoring on CMS installations
  • Block or alert on connections to Keitaro TDS infrastructure and known affiliate marketing platforms associated with traffic monetization schemes; correlate with browser fingerprinting JavaScript execution patterns
  • Implement network-level blocking of newly registered Cloudflare Pages domains (*.pages.dev) in high-risk environments, or apply enhanced scrutiny to domains registered within the past 30 days
  • Detect and prevent installation of remote desktop tools (Ultraviewer, AnyDesk, TeamViewer) by non-administrative users, particularly following browser-based security warnings or unsolicited technical support interactions
  • Deploy browser-based protections against full-screen manipulation and exit prevention techniques; educate users that legitimate Microsoft security alerts never require phone calls to resolve issues

---

# Geopolitical Context

Geopolitical Context

The Help TDS campaign represents a mature Russian-language cybercrime ecosystem that has operated continuously since at least 2017, demonstrating the persistence of profit-driven threat actors within Russia's permissive regulatory environment. The operation's longevity—spanning the ROI777 era (2018), a data breach-driven rebrand to Hotejka, and ongoing infrastructure evolution—illustrates how Russian-speaking cybercriminal networks adapt to exposure while maintaining operational continuity. The use of affiliate models, traffic monetization platforms, and commodity cloud infrastructure (Cloudflare Pages) reflects the professionalization of financially motivated cybercrime originating from jurisdictions with limited law enforcement cooperation. The threat actor's public Telegram presence and explicit advertising of criminal services underscore the low perceived risk of prosecution for Russia-based actors targeting Western victims, consistent with broader patterns of selective enforcement against cybercrime that does not target Russian interests.

State Actor Alignment

Help TDS is attributed to Hotejka, a Russian-language affiliate program assessed to be a rebrand of ROI777 following a March 2018 data breach. While the operation appears to be financially motivated cybercrime rather than state-sponsored activity, it operates within Russia's cyber ecosystem where authorities have historically tolerated or ignored criminal infrastructure targeting foreign victims. The threat actor's use of Russian-language forums, Telegram channels, and affiliate networks is consistent with the broader pattern of cybercriminal operations based in or linked to Russia and former Soviet states. There is no indication of direct state sponsorship, but the operational environment reflects the permissive regulatory climate that has enabled Russian-speaking cybercrime groups to flourish. Western sanctions frameworks targeting cybercrime infrastructure have not demonstrably impacted this operation's seven-year operational lifespan, suggesting limitations in current enforcement mechanisms against diffuse, affiliate-based threat models.

Business Impacty pro region

The campaign's global reach—leveraging over 20,000 Cloudflare Pages domains and compromised WordPress sites worldwide—demonstrates how Russian-language cybercrime infrastructure impacts victims across North America and Europe through tech support scams. The operation's connection to VexTrio Viper, a separate cybercrime affiliate network, illustrates the interconnected nature of the threat landscape where traffic distribution systems function as force multipliers for multiple fraud schemes. European and North American victims face direct financial harm through social engineering and remote access tool deployment, with call centers reportedly operating in Germany processing dozens of fraudulent calls daily. The abuse of legitimate cloud platforms (Cloudflare Pages) and content management systems (WordPress) highlights the challenge facing Western technology providers in distinguishing malicious from legitimate use at scale. The campaign underscores the asymmetry between low-cost attacker infrastructure and the defensive burden placed on website owners, cloud providers, and end users across democratic societies with open internet architectures.

Forecast

If Help TDS maintains its current operational tempo, the use of disposable Cloudflare Pages domains (approximately 300 created daily as of April 2026) is likely to continue straining content delivery network abuse mitigation efforts. Should Western law enforcement agencies pursue coordinated takedown actions targeting Hotejka's affiliate infrastructure, the threat actor may rebrand again or migrate to alternative cloud platforms, consistent with the ROI777-to-Hotejka transition following the 2018 data breach. If Cloudflare implements stricter vetting for Pages domain creation, the operation may shift to other free hosting services or compromised legitimate domains, though this could temporarily reduce scale. The affiliate model's resilience suggests that disrupting individual campaigns will have limited long-term impact without addressing the underlying traffic monetization ecosystem and call center infrastructure. If geopolitical tensions between Russia and Western nations persist without enhanced cybercrime cooperation, operations like Help TDS are likely to continue exploiting the jurisdictional gap, particularly as commodity cloud infrastructure and automation lower barriers to large-scale scam operations.