Russian Hackers Run Record-Breaking Online Ad-Fraud Operation

[UPDATED 12/21 with response from digital ad industry's Trusted Accountability Group (TAG)]

Cybercriminals out of Russia are behind a newly discovered massive online advertising fraud operation hiding in plain site that steals up to $5 million per day from big-name US advertisers by posing as some 6,000 major US media sites including The Huffington Post, Fortune, ESPN, CBS Sports, and Fox News, and generating fake ad impressions.

Researchers at White Ops recently spotted the so-called "Methbot" operation pilfering anywhere from $3 million to $5 million per day in what they say is the largest and most profitable online ad fraud operation in history. Methbot has been operating for three years under cover by a Russian cybercrime group that White Ops has dubbed "AFK14," with a unique twist: its own internal botnet infrastructure runs and automates the click-fraud rather than the traditional ad fraud model of infecting unsuspecting consumers to do the dirty work.

US advertisers in October alone lost a whopping $17.7 million to the criminal hackers, according to White Ops, and AFK13 made some $10.6 million.

AFK13, which is based in Russia, also employs data centers in Dallas and Amsterdam, to run its botnet via spoofed IP addresses that help them evade blacklists. The cybercrime gang created its own Web browser in order to better hide its tracks, as well as its own HTTP library.

"This is the largest operation ever discovered in digital ad fraud," says Eddie Schwartz, president and COO of White Ops, an ad fraud detection firm, which published its findings on AFK13 and its Methbot infrastructure today. "This one is unique in that they went to the trouble of writing their own browser code … They game everything across the entire value chain" of online advertising, he says.

The Methbot network basically drives video and other ad impressions that appear to be humans clicking on them. But video ad "watching" is actually via its botnet of automated Web browsers of more than a half-million Internet addresses using phony IP registrations posing as large ISPs such as Verizon, Comcast, AT&T, Cox, and CenturyLink.

The botnet generates phony impressions for up to 300 million of these ads daily and sends them via 6,111 Internet domains posing as actual ad inventory on brand-name websites, according to White Ops.  

"Ad companies are losing because they're paying the bill" for phony impressions, White Ops' Schwartz says.

Methbot until recently was able to operate under the radar because the Russian cybergang behind it has apparently studied how to avoid detection, including reverse-engineering and duping ad-fraud measures and spoofing fraud verification data so the advertiser sees Methbot's ad impressions as legit, even though they're phony.

AFK13's Methbot has tallied some 200 million to 300 million phony video-ad impressions daily, making an average of $13.04 per CPM, or around $4 million in phony ad inventory revenue each day.

The Russian hackers even have built the bots to imitate mouse movements and social media login information so they appear to be human-generated activity. "They're making the traffic look like residential humans," Schwartz says.

He says the forged and compromised domains made them appear legit to the advertising exchange services that broker ad space inventory for publishers. The exchanges were fooled into believing they were handing the subsequent ad impressions to the publishers, but that phony yet billable traffic instead went to Methbot.

Methbot Bust

But the fraudulent ad operation ended up exposing itself, thanks to a bug in its homegrown HTTP library. "They used a custom HTTP library that was very buggy and set off a bunch of alerts on our system," says White Ops principal researcher Ryan Castellucci, who is credited with first discovering Methbot. The buggy library was "part of why we noticed that they had started ramping up their traffic," they say.

White Ops declined to identify which advertisers have been victimized by Methbot, but they say it's a who's who in online advertising. The company has been working with law enforcement to unmask the operation.

Mike Zaneis, CEO of the digital advertising industry's Tustworthy Accountability Group (TAG), applauded White Ops' findings. "This massive fraud operation represents a significant threat to the integrity of the ecosystem, and it shows why TAG's work is so vital in bringing the digital advertising industry together to share information, adopt rigorous standards, validate best practices, and increase transparency," Zaneis said in a statement.

"Within 24 hours of our notification by White Ops, TAG was able to alert 130 fraud compliance officers at the largest and most influential digital advertising companies and bring the vast majority of those anti-fraud leaders together to learn details of the attack and determine the appropriate action for their companies to take," he said.

Here's how big Methbot stacks up to previous click-fraud campaigns money-wise: ZeroAccess took in about  $900,000 per day; the Chameleon botnet, up to $200,000 per day; and HummingBad, up to $10,000 per day, according to White Ops' report.

Related Content: