VexTrio: The Uber of Cybercrime - Brokering Malware for 60+ Affiliates

Infoblox analysis reveals VexTrio as a long-running, large-scale criminal traffic broker operating HTTP- and DNS-based TDS clusters that leverage DDGA domains and compromised websites (often via vulnerable WordPress/Joomla instances) to route millions of visitors to scams, PUPs, adware/spyware, and malware (notably Glupteba). The network brokers traffic for dozens of affiliates (including SocGholish and ClearFake), runs tens of thousands of domains, and uses profiling-based redirects to maximize malicious monetization while evading takedown.