A Deep Dive into the Triad Nexus Pig Butchering & Money Laundering...
summary
Research claims a Triad Nexus cluster uses a CDN brand called FUNNULL CDN and parent company ACB Group to host hundreds of investment scam and casino sites by rotating CNAME chains into Amazon and low‑quality Asian IPs, sometimes for only 24–72 hours. Analysts map millions of reverse CNAMEs, find a GitHub repo with site templates, Telegram money‑moving contacts, CTG Server as the top IP source, over 1,500 dynamic CNAMEs, and links to Sun City Group laundering (est. $100B).
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 1:24What is Triad Nexus
- 3:51Infrastructure laundering explained
- 8:01Funnel CDN and its role
- 11:53CNAME chain mapping
- 15:46Amazon IP acquisition methods
- 19:15Casino websites and laundering
- 22:25GitHub links and templates
- 24:29Retail fishing scams
- 26:33Future threats and solutions
- 27:35Q&A session
related talks
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
37mTo Loot or Not to Loot? That Is Not a Question When State Nexus APT Targets Online Entertainment
26mStrategic Web Compromises in the Middle East with a Pinch of Candiru
34mFollow the Dynamite: Commemorating TeamTNT's Cloud Attacks
12mTriplet Censors: Demystifying Great Firewall’s DNS Censorship Behavior
28mFerris Bueller's Guide to Abuse Domain Permutations
50mCyber-crime and attacks in the dark side of the web
47mDNS On Fire