The Adtech as a Threat Actor: How Vane Viper Is Hiding in Plain Sight

According to Infoblox, Vane Viper is a prolific threat actor that operates as an adtech platform, using its corporate parent AdTech Holding and subsidiary PropellerAds to run a wide-reaching traffic distribution system. The report notes that Vane Viper has appeared in approximately half of their customer networks and has accounted for about 1 trillion DNS queries over the past year.

Researchers describe the operation as a conspiracy of convoluted ownership and plausible deniability, enabling malicious campaigns to run through adtech with limited accountability. Infoblox also documents that Vane Viper abuses push notifications, malicious browser extensions, and fake download sites, cycling through 60,000 known domains, most of which stay active for only days or weeks.

The findings suggest the group runs its own ad-fraud and malware campaigns, contributing to malvertising, ad fraud, and cyberthreat proliferation for at least a decade. Defenders are urged to use the indicators of compromise provided by Infoblox, including IOCs in their GitHub repository, to monitor for DNS anomalies linked to Vane Viper’s infrastructure.