Inside Help TDS: Hotejka, Cloudflare Pages, and Predictive Detection

The Help TDS operation is a rare case of a threat group maintaining operational security for over seven years, surviving largely unscathed since at least April 2017. Infoblox’s latest research tracks their evolution into using Cloudflare Pages for hosting and a custom JavaScript framework called "Hotejka" to manage redirect chains.

Technical Breakdown – TTPs: The group uses a Traffic Distribution System (TDS) to redirect victims based on geolocation, device fingerprinting, and referrer headers. This filters out bots, researchers, and sandboxes before serving the final payload (typically malware droppers or phishing pages). – Infrastructure: Heavy reliance on Cloudflare Pages for hosting the redirect logic, making takedowns harder due to Cloudflare’s reverse proxy and CDN protections. Domains are rotated aggressively. – Detection: Infoblox’s predictive detection model identifies patterns in domain registration behavior and DNS resolution chains common to Help TDS, rather than relying on static IOCs which are short-lived. – IOCs: No specific hashes or IPs provided in the summary; the value here is the behavioral detection methodology.

Defense Focus on DNS-layer analytics and domain reputation scoring. If your SOC sees redirect chains hitting Cloudflare Pages with geolocation-based filtering, flag for manual review. Traditional blocklists are ineffective here—you need predictive models or sinkholing at the resolver level.

Source: https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/