Cloud networking and cybersecurity company Infoblox has unmasked a Chinese cybercrime syndicate that targets the global USD2.5 trillion illegal sports gambling economy. Infoblox calls the group Vigorish Viper and says it has links to money laundering and human trafficking operations across Asia.
“Vigorish Viper represents one of the most sophisticated and important threats to digital security that we have discovered to date,” said Infoblox Threat Intel Vice President Dr. Renée Burton. “Infoblox Threat Intel used cutting-edge DNS research to discover the technologies underpinning the syndicate. Vigorish Viper created a complex infrastructure with multiple layers of traffic distribution systems (TDSs) using DNS CNAME records and JavaScript, which makes it incredibly difficult to detect. These systems are complemented by their own encrypted communications and custom-developed applications, making their activities not only elusive, but also remarkably resilient.”
The name Vigooish Viper is derived from the exorbitant fees levied on unlucky bettors. The term vigorish, or vig for short, is used by organised crime syndicates to refer to these fees. Viper refers to the complex combination of TDSs and convoluted brand relationships that the actor employs to route users to content. Vigorish Viper leverages sponsorship of popular European sports teams to advertise their illegal gambling sites, which primarily target Greater China.
The research reveals that Vigorish Viper was formed under and controlled by the Yabo Group, a company tied to human trafficking and large-scale cybercrime operations across Southeast Asia. Vigorish Viper has also been central to the sponsorship controversy surrounding several European football clubs, including clubs in the English Premier League.
“This work is particularly important because it connects the physical crimes of human trafficking, money laundering, and fraud, to online crime in a way that hasn’t been done before,” said Burton. “We can now see that organised crime is executing a cunning strategy that uses unwitting European clubs to fuel their criminal cycle.”
The research report from Infoblox details the discovery of Vigorish Viper, how it operates from a technical perspective, its ties to organised crime, and its role in the European football sponsorship scandals. Key findings include:
-
Sophisticated tech suite: Vigorish Viper’s technology suite is a comprehensive cybercrime supply chain, encompassing software, DNS configurations, website hosting, payment systems, and mobile apps.
-
Criminal connections: The technology was developed by “the notorious Yabo Group (also known as Yabo Sports or Yabo) before its reported dissolution in 2022. The Yabo Group has been linked to controversies in Europe surrounding the use of certain football club sponsorships, including several in the English Premier League, such as Manchester United, to illegally advertise unregulated gambling sites in Asia. The Asian Racing Federation Council on Anti-Illegal Betting and Related Financial Crime identified Yabo as “possibly the biggest illegal gambling operation targeting Greater China” and directly tied it to practices of modern slavery in which victims are forced to support gambling services.
-
Elusive operations and DNS knowledge: Vigorish Viper operates a vast network of over 170,000 active domain names, evading detection and law enforcement through its sophisticated use of DNS CNAME traffic distribution systems;
-
European sponsorship controversy: The network is implicated in a scheme that involves securing European football club sponsorships on screens during games or on player jerseys, for example, to advertise illegal gambling sites in Southeast Asia, exploiting the clubs’ popularity to attract bettors.
-
Interconnected threats: Multiple seemingly unrelated gambling brands that advertise through sponsorship deals with certain European sports teams use Vigorish Viper technology. While these brands appear distinct, they operate more like the branches of a franchise, further highlighting the importance of a holistic view on such threats that only DNS brings to the table.
“DNS analytics led to the discovery of Vigorish Viper and constitutes the mechanism for tracking the actor’s infrastructure,” added Burton. “Stopping Vigorish Viper is also most effective via DNS because the actor changes rapidly.”
Despite gambling being almost completely illegal in Greater China, it is estimated that citizens in the region bet nearly USD800 billion annually. This figure underscores the scale and complexity of Vigorish Viper’s operations, with significant implications for global cybercrime.
“Infoblox remains committed to providing actionable intelligence to expose threat actors leveraging DNS for their operations,” said Burton. Our ongoing tracking and exposure of threat actors demonstrates the critical role DNS plays in combating sophisticated cyberthreats, and underscores the industry’s need for continued innovation in DNS and cybersecurity technologies.”
