Triad Nexus Dodges Sanctions, Fuels Sophisticated Cyber Attacks

Triad Nexus Evades Sanctions to Fuel Cybercrime

Triad Nexus, a notorious cybercrime network involved in scams, money laundering, and illicit gambling operations, has developed tactics to circumvent sanctions imposed on it.

• Since its inception in 2020, the network has been responsible for over $200 million in losses primarily due to sophisticated cryptocurrency investment fraud (CIF) scams known as ‘pig butchering’
• Linked to Asian organized crime, Triad Nexus has historically relied on the Funnull content delivery network (CDN) to facilitate various types of fraud

Evasion Methods Employed by Triad Nexus

Following the US sanction of Funnull in 2025, Triad Nexus employed various evasion methods, including:

• Infrastructure laundering
• The use of front companies
• Geo-fencing, to distance itself from the Philippines-based company

Continued Activities and Expansion

In 2024, Silent Push analyzed 200,000 unique hostnames being proxied through Funnull, linking the group to the Polyfill attack and retail phishing scams targeting major brands.

• The group continued to rely on AS152194 (CTG Server Limited) as the backbone of its operation
• To evade post-sanctions monitoring, the group implemented a US block, pivoting to expand into the Spanish, Vietnamese, and Indonesian markets
• Using localized templates to target these regions, its goal was to ensure its illicit profits continued to flow

Conclusion

The use of these tactics allowed Triad Nexus to maintain its illicit activities despite federal sanctions. This case highlights the adaptability and resilience of cybercrime networks and the importance of continuous monitoring and improvement of countermeasures to combat their activities.

About Author

Vaibhav

See author's posts