AtlasCore, PolyFucked & Magnetic Team: Traffer-as-a-Service Infrastructure Targeting Prediction Markets — OTX Pulse Analysis | Security Arsenal

A new convergence of cybercrime and financial fraud has emerged from Russian-language underground communities, where established "traffer teams" — criminal groups specializing in traffic generation and affiliate fraud — have pivoted to exploit the surging popularity of prediction markets including PolyMarket and Kalshi. This campaign represents a maturation of the affiliate fraud ecosystem into a service-oriented criminal enterprise, offering turnkey fraud infrastructure to lower-skilled actors.

Three distinct teams have been identified operating complementary services: AtlasCore, PolyFucked, and Magnetic Team. These groups provide comprehensive fraud-as-a-service (FaaS) packages including convincing phishing websites mimicking legitimate prediction platforms, administrative panels for victim management, cryptocurrency payment processing systems, and technical support for affiliate partners. Their operational model leverages AI-assisted content generation to create highly convincing market predictions and social engineering lures at scale.

The attack chain typically begins with traffic acquisition through malicious advertising, social media manipulation, or SEO poisoning directing users to fraudulent prediction market clones. Victims are induced to deposit cryptocurrency into wallets controlled by the threat actors under the guise of placing bets or purchasing prediction shares. The infrastructure observed utilizes a distributed network of domains designed to resemble legitimate financial and prediction services, with backend C2 infrastructure handling payment processing and victim data exfiltration.

Threat Actor / Malware Profile

Threat Actor: Traffer Teams (AtlasCore, PolyFucked, Magnetic Team)

Classification: Organized Cybercrime / Fraud-as-a-Service Providers Motivation: Financial gain through cryptocurrency theft and affiliate commission fraud Primary Language: Russian Target Sector: Cryptocurrency users, prediction market participants, gambling/platform users

Distribution Method

The actors employ a multi-vector approach leveraging their traffer heritage:

Malvertising campaigns on cryptocurrency forums and prediction market discussion boards
AI-generated content farms publishing fake market analysis to drive organic traffic
Social media impersonation of legitimate prediction market analysts and official accounts
Search engine poisoning for high-intent keywords related to PolyMarket and Kalshi alternatives

Payload Behavior

Unlike traditional malware, this campaign utilizes web-based fraud kits and cryptocurrency wallet drainers:

Fake administrative panels that mimic legitimate prediction market dashboards, showing manipulated odds and fake winnings to encourage larger deposits
Cryptocurrency payment processors that accept deposits but block withdrawals using fabricated "verification requirements" or "liquidity issues"
Browser injection scripts that modify displayed wallet addresses during legitimate transactions on compromised devices

C2 Communication

Command and control infrastructure operates through:

Domain Generation Algorithm (DGA)-like patterns using predictive/betting-themed naming conventions (event-pick.com, forutsagt.bet)
Hardcoded fallback IPs embedded in phishing kit configurations
Encrypted channels (HTTPS/WebSocket) for real-time victim session management
Telegram bot integration for affiliate coordination and victim notification

Persistence Mechanism

Server-side persistence through compromised hosting providers and bulletproof hosting services
Rapid domain rotation when indicators are flagged, utilizing pre-registered backup domains
Affiliate network redundancy allowing operations to continue through partner networks if primary infrastructure is disrupted

Anti-Analysis Techniques

Geofencing to block security researchers and law enforcement from specific regions
Browser fingerprinting to detect virtual machines and automated analysis environments
Time-based activation delaying malicious behavior until sufficient victim trust is established
Domain fronting through legitimate CDN services to obscure true C2 locations

IOC Analysis

The pulse reveals a hybrid infrastructure approach combining traditional C2 with fraud-specific resources:

IPv4 Addresses (2 indicators)

158.94.209.19 — Primary C2 and payment processing server
83.217.208.78 — Backup infrastructure and affiliate management panel

Malicious Domains (104 indicators sampled) The domain indicators reveal a sophisticated naming convention strategy:

Generic prediction themes: predict.biz, event-pick.com
Impersonation attempts: winzo.live (mimicking legitimate gaming platforms)
Localized targeting: forutsagt.bet (Norwegian/Danish "predicted" + betting TLD)
Legitimate-looking business fronts: design.md (potentially compromised or purchased legitimate domain)

Operationalization Guidance: SOC teams should prioritize DNS sinkholing of identified domains and network traffic analysis for the IPv4 indicators. Given the rapid domain rotation typical of traffer operations, implement threat hunting queries for HTTP/S traffic patterns matching prediction market themes rather than static domain blocking alone. The IP indicators show higher persistence value and should be blocked at the network perimeter.

For cryptocurrency tracing, analysts should flag transactions originating from corporate environments to wallet addresses associated with the identified domains. The design.md domain suggests potential abuse of legitimate web services or compromised infrastructure — investigate for subdomain takeover or malicious subdomain creation.

Detection Engineering

YAML

---
title: Suspicious Prediction Market Domain Access
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to domains associated with prediction market fraud infrastructure identified in OTX pulse
date: 2026/10/31
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/pulse/
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'event-pick.com'
            - 'predict.biz'
            - 'gemchange.com'
            - 'winzo.live'
            - 'forutsagt.bet'
    filter:
        query|startswith:
            - 'api.'
            - 'cdn.'
    condition: selection and not filter
fields:
    - query
    - answer
falsepositives:
    - Legitimate prediction market research
    - Security testing
level: high
---
title: Traffer Team Cryptocurrency Fraud Network Communication
id: 8b7c6d5e-4f3a-2b1c-0d9e-8f7a6b5c4d3e
status: experimental
description: Detects network communication to known IP infrastructure used by AtlasCore, PolyFucked, and Magnetic Team operations
date: 2026/10/31
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/pulse/
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp:
            - '158.94.209.19'
            - '83.217.208.78'
        DestinationPort:
            - 80
            - 443
            - 8080
            - 8443
    condition: selection
fields:
    - SourceIp
    - DestinationIp
    - DestinationPort
    - Protocol
falsepositives:
    - Legitimate CDN traffic if IPs are reallocated
level: critical
---
title: Prediction Market Fraud Kit Execution
id: 7c6d5e4f-3a2b-1c0d-9e8f-7a6b5c4d3e2f
status: experimental
description: Detects execution patterns associated with cryptocurrency drainer kits and fake administrative panels used by traffer teams
date: 2026/10/31
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/pulse/
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cmd:
        CommandLine|contains:
            - 'event-pick'
            - 'predict.biz'
            - 'gemchange'
            - 'winzo'
            - 'forutsagt'
            - 'metamask'
            - 'phantom'
            - 'walletconnect'
    condition: selection_img and selection_cmd
fields:
    - Image
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Legitimate cryptocurrency development
    - Security research
level: high

KQL — Microsoft Sentinel / Defender

// Hunt for Traffer Team Infrastructure and Prediction Market Fraud Activity
// Time range: Last 7 days

let SuspiciousDomains = dynamic(["event-pick.com", "predict.biz", "gemchange.com", "winzo.live", "forutsagt.bet", "design.md"]);
let SuspiciousIPs = dynamic(["158.94.209.19", "83.217.208.78"]);

union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (SuspiciousDomains) or RemoteIP in (SuspiciousIPs)
    | extend IndicatorType = case(
        RemoteUrl has_any (SuspiciousDomains), "Domain",
        RemoteIP in (SuspiciousIPs), "IPv4",
        "Unknown"
    )
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, IndicatorType, ActionType
    ),
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any ("event-pick", "predict.biz", "gemchange", "winzo", "forutsagt")
       or ProcessCommandLine contains "metamask" and ProcessCommandLine contains "connect"
       or ProcessCommandLine contains "phantom" and ProcessCommandLine contains "approve"
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName
    )
| sort by TimeGenerated desc

PowerShell

# IOC Hunt Script: Traffer Team Prediction Market Fraud Infrastructure
# Checks for network connections, DNS cache entries, and browser artifacts

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

Write-Host "[+] Starting Traffer Team IOC Hunt - $Timestamp" -ForegroundColor Cyan

# Check for active network connections to known malicious IPs
$MaliciousIPs = @("158.94.209.19", "83.217.208.78")
$MaliciousDomains = @("event-pick.com", "predict.biz", "gemchange.com", "winzo.live", "forutsagt.bet", "design.md")

Write-Host "[+] Checking active network connections..." -ForegroundColor Yellow
$Connections = Get-NetTCPConnection | Where-Object { $MaliciousIPs -contains $_.RemoteAddress } | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

if ($Connections) {
    foreach ($Conn in $Connections) {
        $Process = Get-Process -Id $Conn.OwningProcess
        $Report += [PSCustomObject]@{
            Type = "Network Connection"
            Indicator = $Conn.RemoteAddress
            Details = "Process: $($Process.ProcessName) (PID: $($Process.Id)) | State: $($Conn.State)"
            Severity = "Critical"
            Timestamp = $Timestamp
        }
    }
} else {
    Write-Host "[-] No active connections to malicious IPs detected" -ForegroundColor Green
}

# Check DNS cache for malicious domains
Write-Host "[+] Checking DNS cache..." -ForegroundColor Yellow
$DNSCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Name -or $_.Name -like "*predict*" -or $_.Name -like "*event-pick*" }

if ($DNSCache) {
    foreach ($Entry in $DNSCache) {
        $Report += [PSCustomObject]@{
            Type = "DNS Cache"
            Indicator = $Entry.Name
            Details = "IP: $($Entry.Data) | TTL: $($Entry.TimeToLive)"
            Severity = "High"
            Timestamp = $Timestamp
        }
    }
} else {
    Write-Host "[-] No malicious DNS cache entries found" -ForegroundColor Green
}

# Check browser history (Chrome) for prediction market fraud sites
Write-Host "[+] Checking browser history artifacts..." -ForegroundColor Yellow
$ChromeHistoryPath = "$env:LOCALAPPDATA",

AtlasCore, PolyFucked & Magnetic Team: Traffer-as-a-Service Infrastructure Targeting Prediction Markets — OTX Pulse Analysis