Home › Threat Actors › DriveSurge
← All Threat Actors
Cybercrime critical Unknown

DriveSurge

Suspected pay-per-install initial access broker (Silent Push, 30 May 2026); origin unknown · Financial — suspected pay-per-install access brokering

Reports 1
Active Since 2025 (zTDS server IP in use since 13 September 2025; Silent Push testing from February 2026)
Last Reported 21 Jul 2026
Sectors Targeted finance, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Compromises thousands of legitimate websites, mostly WordPress, and injects JavaScript aimed at non-admin visitors, with backup-domain failover (80+ injection domains)
  • Routes visitors through the open-source zTDS traffic distribution system, which profiles visitors and selects a lure
  • FakeUpdates fake browser-update pages impersonating 11 browsers, and ClickFix lures using a clipboard-hijacking fake reCAPTCHA
  • Base64 (atob) obfuscation of injected scripts
  • Windows ZIP and PowerShell stager payloads and macOS curl|bash payloads
  • Ad-distribution panel; C2 observed at 147.45.42.205:8133
  • Suspected model: follow-on attackers pay per install (Silent Push assessment)

Known Targets

Compromised business, professional-services and local-organisation websites used as injection points (e.g. jclforwarding.com); no geography statedWebsite visitors, who are the end targets of the fake-update and ClickFix lures

Analyst Notes

Source: Silent Push, 30 May 2026. CORRECTION: this profile previously described DriveSurge as an Oracle E-Business Suite (CVE-2026-46817) exploitation actor tied to a Nissan payroll incident, with a CISA KEV listing and 2–5 week dwell times. The only source found for that link is a single Rescana alert (30 June 2026) of low reliability and likely conflation; Silent Push's primary research does not mention Oracle EBS, Nissan or that CVE, and no source supports the KEV, post-patch timing or dwell-time claims, so they were removed. Silent Push notes Russian-language zTDS and panel interfaces but draws no origin conclusion. Silent Push and Malpedia list no aliases or ATT&CK IDs; the IDs below are the site's own mapping of the activity described.

MITRE ATT&CK Techniques

T1189 Drive-by Compromise T1204.004 Malicious Copy and Paste T1059.001 PowerShell T1027 Obfuscated Files or Information

Intelligence Reports

Briefing financecritical-infrastructure

CVE-2026-46817: Oracle EBS Payments RCE Under Active Exploitation — CISA KEV

CISA added CVE-2026-46817, a CVSS 9.8 unauthenticated RCE in Oracle E-Business Suite's Payments module, to the Known Exploited Vulnerabilities catalog on July 15, 2026. Exploitation began six weeks after the May patch, and approximately 950 instances remain exposed. Finance and government organisations running Oracle EBS are at immediate risk.

21 Jul 2026 · 4 min read