Cybercriminals Abuse TDS Infrastructure to Bypass Firewalls and Hide Malicious Destinations

Cybercriminals are increasingly abusing traffic distribution systems (TDSs) to evade defenses, conceal malicious destinations, and funnel victims into phishing, fraud, and malware campaigns.

Once considered a legitimate marketing tool to route visitors to different content or offers, TDS infrastructure is now being repurposed as a stealthy redirection layer that complicates detection and response for network defenders.

Malicious TDS campaigns typically begin with standard reconnaissance and lure techniques: phishing messages with embedded links, search-engine poisoning that elevates fraudulent ads and pages, or the compromise of legitimate websites through weak administrative credentials or unpatched plugins and themes.

After gaining control of a site, actors inject code that redirects visitors into a TDS chain rather than directly to the final payload.

That indirection is the core of the threat: TDSs route traffic through multiple intermediate nodes and domain hops, obscuring the final destination from firewall rule sets, URL filters, and simple blocklists.

The TDS layer provides two operational advantages to attackers. First, by hiding the ultimate malicious host behind transient infrastructure and benign-looking intermediaries, it sidesteps perimeter defenses tuned to known bad domains or IPs.

Second, TDS platforms perform automated visitor profiling collecting IP addresses, OS versions, browser and device attributes, and geolocation to selectively serve malicious content only to high-value or exploitable targets.

That selective targeting reduces collateral exposure to researchers and defenders and increases the campaign’s success rate.

The Federal Bureau of Investigation has issued a Public Service Announcement warning that cybercriminals are increasingly abusing traffic distribution systems (TDSs).

Cybercriminals Abuse TDS Infrastructure

Victims who pass the filters may be redirected to credential-phishing pages, fake banking portals, or installers that deliver JavaScript, PowerShell, or other scripts that fetch ransomware or initial access tools.

The FBI highlights that compromised web properties remain a common vector: weak passwords and outdated CMS components enable brute-force access or exploit chaining, after which actors modify site code to insert TDS redirects.

Attackers also rely on social engineering and SEO manipulation to make malicious entry points appear legitimate.

Once inside a target network, attackers can escalate access, sell credentials on criminal marketplaces, or deploy ransomware and extortion schemes.

Mitigation relies on layered hardening, detection, and user vigilance. For individuals, the FBI recommends scrutinizing URLs before clicking advertisements, enabling automatic software updates, using reputable security plugins.

Web application firewalls (WAFs), enforcing strong passwords and two-factor authentication (2FA), and avoiding unverified third-party themes or plugins.

For organizations, additional defensive measures include changing default file associations to reduce automatic execution of downloaded .js files, monitoring endpoints for suspicious invocations of wscript.exe, cscript.exe, and PowerShell that download or execute web-delivered scripts (notably .js, .ps1, and .svg payloads).

Operational defenders should augment signature-based controls with behavior-focused telemetry: inspect multi-hop redirect chains, correlate outbound DNS patterns and short-lived domain use, and flag conditional content delivery that varies by geolocation or user agent.

Deploying a WAF and enforcing least-privilege access to web administration interfaces reduce the chance of site compromise, while employee training on phishing and social engineering narrows the human attack surface.

This advisory follows prior FBI guidance about web-based fraud and echoes incidents where TDS-enabled chains enabled ransomware groups and financial fraudsters to move from initial phishing to full network compromise.

Security teams should treat unexpected redirections with high suspicion, prioritize telemetry that reveals conditional flows, and coordinate threat intelligence sharing to map transient TDS infrastructure to malicious campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.