'Vane Viper' Threat Group Tied to PropellerAds, Commercial Entities

A high-volume cybercrime operation known as “Vane Viper” that has been active for more than a decade is linked to PropellerAds and its parent AdTech Holding, according to security researchers. Vane Viper takes advantage of hundreds of thousands of compromised websites and malicious ads that redirect users to exploit kits, malware droppers, botnets, scams, and ransomware campaigns, and it uses a traffic distribution system to create obfuscated redirection chains.

The research from Infoblox found Vane Viper to be one of the most prevalent threat groups in the past year, appearing in about half of its customer networks and accounting for roughly 1 trillion DNS queries. PropellerAds is described as a commercial adtech platform that has historically been used for malvertising, with researchers noting that the firm is slow to respond to abuse and that its infrastructure was linked to various fraud and malvertising activities.

The Infoblox report details connections to multiple entities, including domain registrars and hosting providers, and mentions ties to Russian tech entrepreneurs and convicted fraudsters, with Gubarev described as an oligarch associated with XBT Holdings. PropellerAds has not commented on the findings, according to the piece published on 16 September 2025.