{"id":169775,"date":"2025-04-03T21:17:53","date_gmt":"2025-04-03T21:17:53","guid":{"rendered":"https:\/\/peraltafinancing.com\/business\/internet-business\/dollyways-eight-year-evolution-from-master134-to-modern-malware-infrastructure\/"},"modified":"2025-04-03T21:17:53","modified_gmt":"2025-04-03T21:17:53","slug":"dollyways-eight-year-evolution-from-master134-to-modern-malware-infrastructure","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=169775","title":{"rendered":"DollyWay’s Eight-Year Evolution: From Master134 to Modern Malware Infrastructure"},"content":{"rendered":"
\n<\/p>\n
\n
\n
\n
Key findings\u00a0<\/h2>\n
\n
The DollyWay World Domination operation evolved through multiple distinct campaign phases since 2016, showing increasing sophistication in both technical capabilities and infrastructure.\u00a0<\/li>\n<\/ul>\n
\n
Campaign maintained consistent monetization partnerships while advancing evasion and persistence techniques.\u00a0<\/li>\n<\/ul>\n
\n
Infrastructure evolution demonstrates clear learning patterns, with each iteration building upon previous successful elements.\u00a0\u00a0<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
The DollyWay World Domination\u2019s eight-year evolution from simple script injections to sophisticated multi-stage malware provides unique insights into how threat actors adapt and mature their techniques over time. This analysis follows the DollyWay operation’s development through seven distinct campaigns, revealing how each iteration built upon previous successes while introducing new capabilities.\u00a0<\/p>\n
By examining technical artifacts, shared infrastructure components, and consistent monetization patterns across multiple campaign phases, we’ve reconstructed the DollyWay malware’s complete operational history \u2014 from its earliest days as Master134 through its current more sophisticated form. This timeline demonstrates how threat actors learn from both successes and failures while maintaining core operational elements that enable long-term campaign tracking.\u00a0<\/p>\n
Related posts:<\/strong><\/p>\n
DollyWay World Domination timeline\u00a0<\/h2>\n
Initially, some of the malware campaigns may seem unrelated, but we managed to link them to the same operators by observing the same ad network affiliate ids in their redirect links, common techniques and shared malware codebase.\u00a0<\/p>\n
\n<\/figure>\n<\/div>\n
Master134 (November 2016 – 2020)\u00a0<\/h3>\n
The earliest identified campaign in this operation was named Master134 after the IP address used in its injections: 134.249.116[.]78 \u00a0<\/p>\n
According to CheckPoint research, this campaign compromised over 10,000 sites and redirected visitors through various ad networks including AdsTerra and PropellerAds. \u00a0<\/p>\n
While normal ads served by these ad networks are usually legitimate, many ads served to the visitors redirected by the Master134 malware proved to be malicious. <\/p>\n
According to the CheckPoint research:\u00a0<\/p>\n\n
\n
The list of redirection chains includes major players in the Exploit Kit landscape, along with some other malicious sites: Fobos, HookAds, Seamless, BowMan, TorchLie, BlackTDS and Slyip, all redirect to the Rig Exploit Kit. In addition, redirections to Magnitude Exploit Kit, GrandSoft Exploit Kit, FakeFlash and Technical Support Scams can also be found in the list.<\/em>\u00a0<\/p>\n<\/blockquote>\n
![\"\"](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image-27.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n