vacant_viper
Vacant Viper is a cybercriminal threat actor associated with the Russian-hosted 404TDS traffic distribution system. Reporting describes it as one of the earliest known actors exploiting the Sitting Ducks domain hijacking technique, with activity ongoing since December 2019 and an estimated 2,500 hijacked domains per year. The actor hijacks registered domains, including high-reputation domains, and uses them to augment 404TDS for malicious spam operations, porn delivery, remote access trojan (RAT) command-and-control, and malware delivery. Malware and payloads directly mentioned in the reporting include AsyncRAT, DarkGate, and, in one report, IcedID and other malware. Vacant Viper is also described as delivering numerous RATs. The content states that Vacant Viper is known to affiliate with TA571. Aliases directly provided in the content are limited to 'vacant_viper' / 'Vacant Viper'.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Vacant Viper hijacks domain names and uses a custom traffic distribution system (404TDS) to deliver various remote access trojans (RATs).
Vacant Viper hijacks high-reputation domains using Sitting Ducks attacks to build a malicious traffic distribution system (404TDS) for spam, malware delivery, and C2 infrastructure.
Vacant Viper is a criminal group involved in DNS hijacking attacks, using compromised domains to distribute malware such as AsyncRAT and DarkGate.
Vacant Viper leverages Sitting Ducks domain hijacking to operate traffic distribution systems (TDS), run spam campaigns, deliver adult content, establish C2 infrastructure, and distribute malware including DarkGate and AsyncRAT.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.