Illegal Betting Linked to Cyber Crime & Football Globally

A leader in cloud networking and security services, Infoblox, announced a significant breakthrough in cybercrime investigation yesterday, with the unmasking of a cyber-threat actor that the company has named “Vigorish Viper.” Vigorish Viper is a Chinese organized crime syndicate that utilizes a sophisticated technology suite to take advantage of the global $1.7 trillion illegal sports gambling economy, with links to money laundering and human trafficking operations across Asia.

“Vigorish Viper represents one of the most sophisticated and important threats to digital security that we have discovered to date,” said Dr. Renée Burton, Vice President, Infoblox Threat Intel. “Infoblox Threat Intel used cutting-edge DNS research to discover the technologies underpinning the syndicate.

According to their report, Vigorish Viper created a complex infrastructure with multiple layers of traffic distribution systems using DNS CNAME records and JavaScript, which makes it incredibly difficult to detect. These systems are enhanced with their own encrypted communications and custom-developed applications, making their activities elusive as well as remarkably resilient.

Vigorish Viper has leveraged sponsorship of popular European sports teams to advertise for their illegal gambling sites, which primarily target Greater China.

Dr. Renée Burton added, “This work is particularly important because it connects the physical crimes of human trafficking, money laundering, and fraud, to online crime in a way that hasn’t been done before. We can now see that organized crime is executing a cunning strategy that uses unwitting European clubs to fuel their criminal cycle.”

Key findings of the Report Include:

• Sophisticated Tech Suite: Vigorish Viper’s technology suite is a comprehensive cybercrime supply chain, encompassing software, DNS configurations, website hosting, payment systems, and mobile apps.
• Criminal Connections: The technology was developed by the notorious Yabo Group (also known as Yabo Sports or Yabo) prior to its reported dissolution in 2022. The Yabo Group has been linked to controversy in Europe surrounding the use of certain football club sponsorships, including several in the English Premier League such as Manchester United, to illegally advertise unregulated gambling sites in Asia. The Asian Racing Federation (ARF) Council on Anti-Illegal Betting and Related Financial Crime identified Yabo as “possibly the biggest illegal gambling operation targeting Greater China” and directly tied it to practices of modern slavery in which victims are forced to support gambling services.
• Elusive Operations & DNS Knowledge: Vigorish Viper operates a vast network of over 170,000 active domain names, evading detection and law enforcement through its sophisticated use of DNS CNAME traffic distribution systems.
• European Sponsorship Controversy: The network is implicated in a scheme that involves securing European football club sponsorships on screens during games, or on player jerseys for example, to advertise illegal gambling sites in Southeast Asia, exploiting the clubs’ popularity to attract gamblers.
• Interconnected Threats: Tens of seemingly unrelated gambling brands that advertise by way of sponsorship deals with certain European sports teams use Vigorish Viper technology. While these brands appear distinct, they operate more like the branches of a franchise, further highlighting the importance of a holistic view on such threats that only DNS brings to the table.

Adding to the gravity of the situation, despite gambling being almost completely illegal in Greater China, it is estimated that citizens in the region bet nearly US$850 billion annually. This staggering figure underscores the scale and complexity of Vigorish Viper’s operations, with significant implications for global cybercrime.