← Traffic Distribution Systems in the Cybercrime Ecosystem
Module 1: Routing, Filtering, and Names
What a TDS Does—and Does Not Prove Why Victims and Sandboxes See Different Pages A Field Guide to TDS Names
Module 2: Named Services and Campaigns
Keitaro, ParrotTDS, TA2726, and SocGholish 404 TDS and TA584's Changing Initial Access Prometheus TDS, Cookie Reloaded, and TA866 VexTrio: Affiliate Traffic and DNS Routing
Module 3: Modern and Historical TDS Case Files
TAG-124, KongTuke, LandUpdate808, and Chaya_002 zTDS and the 2026 DriveSurge Cluster BlackTDS, Sutra, and the Drive-by Service Model
Module 4: Hosting, Networks, Investigation, and Disruption
Bulletproof Hosting in the TDS Ecosystem Fast Flux, Shared Hosting, CDNs, and Cloud Investigate and Disrupt the Complete Chain
Module 3: Modern and Historical TDS Case Files

zTDS and the 2026 DriveSurge Cluster

Examine an open-source TDS abused at scale and a current infrastructure fingerprint.

In this lesson, you will learn to:

  • Reconstruct the DriveSurge chain.
  • Use an infrastructure fingerprint as a candidate generator rather than a verdict.

zTDS and the 2026 DriveSurge Cluster

Uses Silent Push’s May 2026 DriveSurge reporting to connect compromised sites, zTDS, .icu domains, named DNS and ASN observations, ClickFix, FakeUpdates, and an assessed pay-per-install model.

Thousands of sites fed an open-source TDS

Silent Push named DriveSurge in May 2026 after observing drive-by clusters that compromised thousands of legitimate websites. Injected scripts sent visitor data to domains running zTDS, an open-source TDS available since at least 2015. Selected Windows or macOS visitors could receive ClickFix or fake-update lures; bots and other visitors could remain on the legitimate page.

Silent Push assessed that the cluster likely operated as an initial-access broker using a pay-per-install model. Phrase that as an assessment, not a proven contract. The technical chain—compromised site → injected script → zTDS classification → deceptive lure → execution or download—is independently useful. A public tool can be abused without every installation or contributor being criminal.

A field of trusted sites feeds zTDSA site field highlights compromised sources quietly forwarding selected visitors into one routing layer.LEARN IT VISUALLYA field of trusted sites feeds zTDSSite ASite BSite CSite DSite E
A field of trusted sites feeds zTDS — A site field highlights compromised sources quietly forwarding selected visitors into one routing layer.

DriveSurge exposed a reusable infrastructure pattern

Silent Push reported a recurring pattern across many DriveSurge domains: the .icu top-level domain, the nameserver ns1.erans[.]ru, self-named mail exchange records, NiceNIC registration, and Autonomous System numbers AS203273 and AS210644. A May 2026 search using that combination produced 90 hostnames and 39 unique domains after removing subdomains; seven had not yet delivered observed malicious injections at publication time.

This is a fingerprint for prioritizing investigation, not proof that every .icu domain, NiceNIC customer, nameserver user, or address in those ASNs is malicious. Validate registration time, DNS history, injected-script fingerprints, response behavior, and campaign timing. Network assets and customers can change. Preserve the exact query logic and observation date so another analyst can reproduce the candidate set.

Eight fingerprints narrow the DriveSurge searchA fingerprint grid combines script forms, domains, DNS, registration, ASN, and response behavior.LEARN IT VISUALLYEight fingerprints narrow the DriveSurge search01Inject t.js02Hashed name03ext-b form04zTDS call05.icu06Name server07ASNs08Response
Eight fingerprints narrow the DriveSurge search — A fingerprint grid combines script forms, domains, DNS, registration, ASN, and response behavior.

Detect both website and endpoint stages

Website monitoring can identify changed core files, unauthorized script tags, unfamiliar outbound domains, new administrative users, and suspicious scheduled tasks. DNS and web telemetry can reveal newly observed zTDS domains and short redirect chains. Browser and endpoint telemetry can capture fake-update downloads, clipboard-to-shell sequences, script interpreters, and subsequent persistence.

For a compromised site, preserve the injection before removal, reset credentials, remove persistence, patch vulnerable software, review logs, rotate exposed secrets, and monitor recurrence. For an affected visitor, determine whether the lure was displayed, whether a command or file executed, what credentials were exposed, and what downstream activity followed. Seeing the site is not the same as infection; seeing the file is not the same as execution.

Resources

  • Silent Push: DriveSurge — Use the May 2026 source for zTDS, compromised-site scale, infrastructure fingerprints, ASN observations, and pay-per-install assessment.
← Previous: TAG-124, KongTuke, LandUpdate808, and Chaya_002 Next: BlackTDS, Sutra, and the Drive-by Service Model →