Triad Nexus Expands Global Fraud Operations Despite US Sanctions

Silent Push research details Triad Nexus, a sophisticated cybercrime network blamed for over $200M in losses, which has evolved post-2025 sanctions by strengthening operational security, using compromised cloud accounts (AWS, Cloudflare, Google, Microsoft) for "infrastructure laundering," and running large-scale brand impersonation and investment scams. The group implements a US IP block to evade investigators, localizes scams for Spanish, Vietnamese, and Indonesian markets, and uses clean front companies to hinder attribution; defenders are advised to adopt proactive monitoring and use tools such as CNAME Chain Lookup to map layered infrastructure.