Prometheus TDS

**Executive summary:** This Group-IB analysis describes Prometheus TDS, a commercialized Traffic Direction System that uses compromised websites and a Prometheus.Backdoor to fingerprint visitors and selectively deliver malicious payloads or redirects; it was used in campaigns distributing multiple loaders and banking/stealer malware (Hancitor, Campo/BazaLoader, IcedID, QBot, Buer, SocGholish, Ficker, etc.), affected over 3,000 targets (notably Belgium individuals and U.S. organizations), and is offered for sale on underground forums.