New Infoblox Research Uncovers Vault Viper, Links It to Criminal Underworld
Responsible for the Creation and Operation of the Universe Browser
Infoblox Threat Intel (ITI), together with the United Nations Office on Drugs and Crime (UNODC), has linked BBIN, also known as Baoying Group, one of Asia’s largest iGaming providers, through interlocking corporate ownership structures and affiliations, to cyber-enabled fraud, illegal online gambling, and organised crime in Southeast Asia. At the heart of ITI’s research is the Universe Browser, advertised as a privacy tool for gamblers seeking to evade censorship. But, in fact, it is the perfect tool for covert surveillance and potential exploitation of players.
ITI uses the actor name “Vault Viper” to refer to a conglomeration of commercial entities and known criminal endeavours spread around the world, centred around BBIN, and worth tens of millions of pounds. The actor is responsible for the creation and operation of the Universe Browser.
DNS analysis from Infoblox reveals tens of thousands of domains tied to Vault Viper’s vast infrastructure, exposing a unique DNS fingerprint, and operational control over their own corner of the internet.
Key Findings About Vault Viper
-
Privacy Promise, Risky Reality: The browser developed by Vault Viper, Universe Browser, claims to protect users, but can covertly install software consistent with surveillance, credential theft, and remote access.
-
Massive Infrastructure: Vault Viper controls tens of thousands of domains sharing a specific DNS fingerprint. Infoblox Threat Intel unravelled the group’s entire online infrastructure, and revealed they directly control an ASN and several large companies.
-
Casino and Crime Connections: By following a DNS trail spanning two decades, Infoblox researchers found that Vault Viper overlaps largely with BBIN, also known as Baoying Group, which is also linked to dozens of commercial ventures from airlines, to casinos, to IT companies.
-
Defying Bans: Even after offshore gambling was outlawed in the Philippines, Vault Viper continues to operate, serving illegal casinos based in Cambodia.
Vault Viper is not just a tech problem—it is a global crime story. By exposing this operation, Infoblox aims to help law enforcement, businesses, and everyday internet users stay one step ahead of the bad guys. The convergence of cybercrime and organised crime is real, and it is happening right now.
Read the full research here: https://blogs.infoblox.com/threat-intelligence/vault-viper-high-stakes-hidden-threats/.
