FBI Shuts Down Multimillion Dollar – 3ve – Ad Fraud Operation

Google, the FBI, ad-fraud fighting company WhiteOps and a
collection of cyber security companies worked together to shut down
one of the largest and most sophisticated digital ad-fraud schemes
that infected over 1.7 million computers to generate fake clicks
used to defraud online advertisers for years and made tens of
millions of dollars in revenue.

Dubbed 3ve (pronounced “Eve”), the online ad-fraud
campaign is believed to have been active since at least 2014, but
its fraudulent activity grew last year, turning it into a
large-scale business and earning their operators more than $30
million in profit.

Meanwhile, the United States Department of Justice (DoJ) also
unsealed Tuesday a 13-count indictment against 8 people from
Russia, Kazakhstan, and Ukraine who allegedly ran this massive
online advertising scheme.

The 3ve botnet scheme deployed different tactics, such as creating
their own botnets, creating fake versions of both websites and
visitors, selling fraudulent ad inventory to advertisers, hijacking
Border Gateway Protocol (BGP) IP addresses, using proxies to hide
real IP addresses, and infecting users PCs with malware—all to
create or generate fake clicks over online ads and get paid.

3ve involved 1.7 million computers infected with malware, over 80
servers in generating fake internet traffic, more than 10,000
counterfeit websites to impersonate legitimate web publishers, and
over 60,000 accounts selling ad inventory via more than one million
compromised IP addresses to generate 3 to 12 billion of daily ad
bid requests at its peak.

3ve Ad Fraud Operation – Types and Working

According to Google and multiple cybersecurity firms, the
ad-fraud scheme has been named 3ve because it relies on a set of
three distinct sub-operations, “each taking unique measures to
avoid detection, and each built around different architectures
using different components.”

Here’s a brief overview of all three 3ve operations:

3VE.1—The BOAXXE Malware Scheme, aka METHBOT or MIUREF

The first 3ve’s three ad fraud sub-operations, called 3ve.1 for the
sake of clarity, was powered by a network of bots operating in data
centers across the US and Europe.

This operation used the Boaxxe botnet, also known as
Miuref and Methbot, and BGP hijacking to obtain IP addresses used
for proxying the traffic from the infected devices in the data
centers and visit fake and real web pages.

Initially, all the fake ad requests originated from desktop
browsers, but over time, this operation increasingly started
relying on spoofed mobile traffic from Android devices—ad-requests
spoofed to look like they came either from mobile apps or from
mobile browsers.

Between September 2014 and December 2016, this scheme used 1,900
computer servers hosted in commercial data centers to load ads from
advertisers on over 5,000 counterfeit websites, generating millions
of dollars in profit for its operators.

3VE.2—The KOVTER Malware Scheme

This approach used counterfeit domains to sell fake ad inventory to
advertisers. However, instead of relying on proxies to hide its
activities, this approach deployed a hidden, custom browsing agent
(Chromium Embedded Framework) on more than 700,000 computers
infected with the Kovter malware.

This scheme made use of redirection servers that instructed
the infected computers to visit specific fake web pages.

Detected by ESET in 2014, Kovter was initially a piece of
ransomware, but the family has evolved since then to become ad
fraud malware with its ability to send fake traffic if it detects a
network monitor, terminate its own spawned process if Windows Task
Manager is started, use so-called “fileless” persistence by storing
its malicious payload encrypted in the Windows registry, and
more.

3VE.3—Data Centers IPs as Proxies

The third 3ve-associated sub-operation was similar to 3ve.1. Its
bots were based in a few data centers, but in order to cover its
tracks, it used the IP addresses of other data centers as proxies
(exit node layer) instead of residential computers.

Although data centers are far more suspicious to advertisers who
are worried about bot traffic, 3ve.3 strategy still allowed a
reasonable degree of agility by helping its operators find new data
centers as soon as old data centers were blocked.

Authorities Take Down “3ve” Ad Fraud Operation

Google uncovered the 3ve operations last year while its companies
were assessing the impact of the Methbot operation, an underground
ad fraud enterprise that White Ops revealed in 2016, which ESET
named as the Boaxxe
botnet^[3].

However, after 3ve’s activity grew in 2017, generating
billions of daily ad bid requests, Google collaborated with other
security companies who were independently investigating this
prominent ad-fraud operation to take down the entire 3ve network.

Google and other security firms worked with the FBI to shut down
the massive ad-fraud operation. After obtaining warrants last
month, the FBI seized 31 internet domains and 89 servers that were
all part of the 3ve infrastructure.

Cybersecurity companies in the private sector also helped blacklist
the 3ve infrastructure engaged in the ad-fraud scheme and sinkhole
the traffic to the bad domains.

8 People Charged Over Multimillion-Dollar Ad Fraud Scheme

On Tuesday, the U.S. Justice Department indicted eight
people^[4] allegedly involved
in the infamous 3ve online advertising scams, which included five
Russian nationals, one person from Russia and Ukraine, and two
people from Kazakhstan. Three of them have already been arrested.

1. Aleksandr Zhukov (38, Russian Federation) [arrested from
   Bulgaria]
2. Boris Timokhin (39, Russian Federation) [arrested from
   Estonia]
3. Mikhail Andreev (34, Russian Federation and Ukraine)
4. Denis Avdeev (40, Russian Federation)
5. Dmitry Novikov (Russian Federation)
6. Sergey Ovsyannikov (30, Republic of Kazakhstan) [arrested from
   Malaysia]
7. Aleksandr Isaev (31, Republic of Kazakhstan)
8. Yevgeniy Timchenko (30, Republic of Kazakhstan)

The defendants are charged with 13 counts of criminal
violations, including wire fraud, aggravated identity theft, money
laundering, and conspiracy to commit computer intrusion, among
other offenses.