Organization:Satori Threat

From HandWiki
Satori Threat Intelligence and Research Team
AbbreviationSatori
Formation2019
TypeThreat intelligence and research unit
Parent organization
HUMAN Security
Websitewww.humansecurity.com/company/satori-threat-intelligence/

The Satori Threat Intelligence and Research Team (Satori) is the threat intelligence unit of HUMAN Security, an American cybersecurity company formerly known as White Ops. Formed in 2019, it investigates botnets, online advertising fraud and malvertising, and publishes technical reports on its findings.[1][2]

Its work, and that of its predecessor researchers at White Ops, has been credited by United States federal prosecutors and the Federal Bureau of Investigation (FBI) in investigations of digital advertising fraud, including the Methbot and 3ve operations and the BADBOX botnets.[3][4]

History

White Ops, the company that later became HUMAN Security, was founded in New York City in 2012 by a team that included the chief executive Michael Tiffany, the chief scientist Dan Kaminsky and the chief technology officer Tamer Hassan, and applied fraud-detection methods developed for banking to the digital advertising market.[5][6] The company formed the Satori Threat Intelligence and Research Team in February 2020; it said the unit's name was taken from the Japanese Buddhist term satori.[7] White Ops was acquired by a Goldman Sachs-led group in December 2020, renamed itself HUMAN in 2021 and merged with PerimeterX in 2022; the Satori unit continued through each change.[8][6]

Investigations

In December 2016, White Ops, and its then-unnamed threat intelligence team, disclosed Methbot, a video advertising fraud operation that ran on a network of data center servers using hundreds of thousands of leased IP addresses to serve fabricated video advertisements, estimated to generate several million dollars per day.[9] It later worked with Google on a larger operation known as 3ve, which by 2018 was running hidden browsers on more than 1.7 million infected computers.[10]

A 2018 federal indictment charged eight defendants over the two schemes, crediting White Ops and Google with assisting the investigation and takedown; the lead defendant, Aleksandr Zhukov, was convicted in 2021 and sentenced to ten years' imprisonment.[3]

Between 2020 and 2024 the team disclosed a series of advertising fraud operations that abused mobile applications and connected TV devices, among them ICEBUCKET, TERRACOTTA, Pareto, Scylla, VASTFLUX and Konfety; several involved apps removed from the Google Play and Apple app stores after millions of downloads, and some spoofed connected-TV devices to attract higher advertising rates.[11][12][13]

In October 2023 Satori disclosed BADBOX, a supply-chain compromise in which tens of thousands of off-brand Android devices were shipped with a firmware backdoor and a linked ad fraud module named PEACHPIT.[14] In March 2025 it disclosed and helped disrupt a larger successor, BADBOX 2.0, which infected around one million consumer devices used for ad fraud and as residential proxies; working with the Shadowserver Foundation, Google and Trend Micro, the team cut off communications for more than 500,000 devices.[15][16] Germany's Federal Office for Information Security had sinkholed the malware on up to 30,000 devices in December 2024, and in June 2025 the FBI issued a public service announcement (Alert Number: I-060525-PSA)[17] crediting HUMAN Security and its partners; a Google lawsuit the following month described the botnet as the largest known of connected-television devices.[18][19][20][21][22]

In October 2024, Satori disclosed Phish 'n' Ships, a fraud operation in which more than 1,000 legitimate websites were infected to plant fake listings for hard-to-find products; the listings sent shoppers to 121 fraudulent web stores that abused third-party payment processors to take payment and card details without shipping the goods. The researchers dated the scheme to 2019 and estimated losses of tens of millions of dollars affecting hundreds of thousands of consumers; the fake listings were removed from Google search results and the payment processors closed the operators' accounts.[23][24][25]

Later disclosures included SlopAds (September 2025), a ring of 224 Android apps downloaded about 38 million times, and, in 2026, the AI-assisted scareware campaign Pushpaganda and the Android malvertising operation Trapdoor; in each case Google removed the identified apps or updated Google Play Protect in response.[26][27][28]

See also

References

  1. ↑ "New team of White Ops experts to help clients and security practitioners fight sophisticated bot attacks" (in en-US). 2020-02-13. https://www.helpnetsecurity.com/2020/02/13/white-ops-satori-threat-intelligence-and-research-team/. 
  2. ↑ "BADBOX 2.0 Botnet Infects 1 Million Android Devices for Ad Fraud and Proxy Abuse" (in en). http://thehackernews.com/2025/03/badbox-20-botnet-infects-1-million.html. 
  3. ↑ 3.0 3.1 "Two International Cybercriminal Rings Dismantled and Eight Defendants Indicted for Causing Tens of Millions of Dollars in Losses in Digital Advertising Fraud". U.S. Attorney's Office for the Eastern District of New York. November 27, 2018. https://www.justice.gov/usao-edny/pr/two-international-cybercriminal-rings-dismantled-and-eight-defendants-indicted-causing. 
  4. ↑ "Internet Crime Complaint Center (IC3) | Home Internet Connected Devices Facilitate Criminal Activity". https://www.ic3.gov/PSA/2025/PSA250605. 
  5. ↑ Sluis, Sarah (13 February 2017). "How fraud-fighter White Ops helped put ad waste on the map". https://digiday.com/marketing/fraud-fighter-white-ops-helped-put-ad-waste-map/. 
  6. ↑ 6.0 6.1 Sawers, Paul (July 27, 2022). "Human Security merges with PerimeterX to thwart bots and automated fraud". https://techcrunch.com/2022/07/27/human-security-merges-with-perimeterx-to-thwart-bots-and-automated-fraud/. 
  7. ↑ "New team of White Ops experts to help clients and security practitioners fight sophisticated bot attacks" (in en-US). 2020-02-13. https://www.helpnetsecurity.com/2020/02/13/white-ops-satori-threat-intelligence-and-research-team/. 
  8. ↑ "Goldman Sachs Buys Anti-Bot Startup White Ops" (in en-US). 2020-12-28. https://www.securityweek.com/goldman-sachs-buys-anti-bot-startup-white-ops/. 
  9. ↑ Krebs, Brian (20 December 2016). "Report: $3–5M in Ad Fraud Daily from 'Methbot'". https://krebsonsecurity.com/2016/12/report-3-5m-in-ad-fraud-daily-from-methbot/. 
  10. ↑ "Eight People Are Facing Charges As A Result Of The FBI’s Biggest-Ever Ad Fraud Investigation" (in en). BuzzFeed News. https://www.buzzfeednews.com/article/craigsilverman/3ve-botnet-ad-fraud-fbi-takedown. 
  11. ↑ Kovacs, Eduard (22 April 2021). "Massive Android Botnet Hits Smart TV Ad Ecosystem". https://www.securityweek.com/massive-android-botnet-hits-smart-tv-ad-ecosystem/. 
  12. ↑ Toulas, Bill (21 January 2023). "Massive ad fraud op dismantled after hitting millions of iOS devices". BleepingComputer. https://www.bleepingcomputer.com/news/security/massive-ad-fraud-op-dismantled-after-hitting-millions-of-ios-devices/. 
  13. ↑ Lakshmanan, Ravie (16 July 2024). "Konfety Ad Fraud Uses 250 Google Play Decoy Apps to Hide Malicious Twins". The Hacker News. https://thehackernews.com/2024/07/konfety-ad-fraud-uses-250-google-play.html. 
  14. ↑ Paganini, Pierluigi (9 October 2023). "Android devices shipped with backdoored firmware as part of the BADBOX network". https://securityaffairs.com/152124/malware/badbox-network-backdoored-firmware.html. 
  15. ↑ Lakshmanan, Ravie (18 March 2025). "BADBOX 2.0 Botnet Infects 1 Million Android Devices for Ad Fraud and Proxy Abuse". The Hacker News. https://thehackernews.com/2025/03/badbox-20-botnet-infects-1-million.html. 
  16. ↑ Toulas, Bill (5 March 2025). "BADBOX malware disrupted on 500K infected Android devices". BleepingComputer. https://www.bleepingcomputer.com/news/security/badbox-malware-disrupted-on-500k-infected-android-devices/. 
  17. ↑ "Home Internet Connected Devices Facilitate Criminal Activity". Federal Bureau of Investigation. June 5, 2025. https://www.fbi.gov/investigate/cyber/alerts/2025/home-internet-connected-devices-facilitate-criminal-activity. 
  18. ↑ "BSI stoppt Schadsoftware Badbox auf 30.000 Geräten in Deutschland" [BSI stops Badbox malware on 30,000 devices in Germany] (Press release) (in Deutsch). Bundesamt für Sicherheit in der Informationstechnik. 12 December 2024. Retrieved 2026-08-04.
  19. ↑ "Home Internet Connected Devices Facilitate Criminal Activity". 5 June 2025. https://www.ic3.gov/PSA/2025/PSA250605. 
  20. ↑ Claburn, Thomas (17 July 2025). "Google sues 25 unnamed Chinese entities behind BADBOX 2.0 botnet". The Register. https://www.theregister.com/2025/07/17/google_sues_25_unnamed_chinese/. 
  21. ↑ "We’re taking legal action against the BadBox 2.0 botnet." (in en-us). 2025-07-17. https://blog.google/innovation-and-ai/technology/safety-security/google-taking-legal-action-against-the-badbox-20-botnet/. 
  22. ↑ Writer, Staff. "BADBOX 2.0 Case Study: Google’s July 2025 Lawsuit Against the Botnet Infecting 10 Million Residential Android Open-Source IoT Devices - Inland Cyber Defense Clinic (ICDC)" (in en-US). https://research.cgu.edu/icdc/2025/07/19/badbox-2-0-case-study/. 
  23. ↑ French, Laura (2024-10-31). "Fake product listings on real shopping sites lead to stolen payment information" (in en). https://www.scworld.com/news/fake-product-listings-on-real-shopping-sites-lead-to-stolen-payment-information. 
  24. ↑ French, Laura (2024-10-31). "Fake product listings on real shopping sites lead to stolen payment information" (in en). https://www.scworld.com/news/fake-product-listings-on-real-shopping-sites-lead-to-stolen-payment-information. 
  25. ↑ French, Laura (2024-10-31). "Fake product listings on real shopping sites lead to stolen payment information" (in en). https://www.scworld.com/news/fake-product-listings-on-real-shopping-sites-lead-to-stolen-payment-information. 
  26. ↑ Lakshmanan, Ravie (19 May 2026). "Trapdoor Android Ad Fraud Scheme Hit Millions of Victims Worldwide". The Hacker News. https://thehackernews.com/2026/05/trapdoor-android-ad-fraud-scheme-hit.html. 
  27. ↑ Lakshmanan, Ravie (April 14, 2026). "AI-Driven Pushpaganda Scam Exploits Google Discover to Spread Scareware and Ad Fraud". https://thehackernews.com/2026/04/ai-driven-pushpaganda-scam-exploits.html. 
  28. ↑ Abrams, Lawrence (September 16, 2025). "Google nukes 224 Android malware apps behind massive ad fraud campaign". https://www.bleepingcomputer.com/news/security/google-nukes-224-android-malware-apps-behind-massive-ad-fraud-campaign/. 



Retrieved from "https://handwiki.org/wiki/index.php?title=Organization:Satori_Threat&oldid=4627290"