Learn
archived
Help TDS/Hotejka Affiliate Network Abuses Cloudflare Pages for Scams
- Engineer — Learn: The campaign installs PHP TDS templates on compromised websites, which is a useful reminder to audit PHP applications for unauthorized file drops; no specific CVE or exploitation signal to act on.
- SOC/IR — Learn: Attribution linking Help TDS to Hotejka/ROI777 adds actor context, but the summary provides no IOCs or ATT&CK-mappable TTPs to build detections or hunt on today.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.