Spring of Satori: Deconstructing BADBOX2, Phish n’ Ships, Big Sports Gambling

Spring is in the air and that means The Satori Threat Intelligence team is back with a rundown of our latest research! Join us on April 15 at 1pm est Spring of Satori, as we go into detail about all the operations we uncovered, took down and disrupted so far in 2025. This virtual panel will include Lindsay Kaye, our VP, Threat Intelligence in Threat Intel along with members of our distinguished Satori Team João Santos and Gabi Cirlig. Together they will give you the anatomy of a threat intel operation and answer all your questions from the POV of a digital detective. 

This HUMAN Dialogue will cover: 

• BADBOX 2.0
  • The largest botnet of CTV devices ever uncovered. BADBOX 2.0 is a sophisticated, sprawling fraud operation centered on a collection of Android applications and devices backdoored by threat actors of Chinese origin – they used these devices to conduct programmatic ad fraud, click fraud, proxyjacking and creating and operating a botnet with the devices. 

• Phish’n’Ships
  • An investigation in which we saw threat actors using a network of fake shops that collected payment for goods such as clothes, gaming miniatures or books, and then never delivered the product. HUMAN observed thousands of hacked hosting sites leading to hundreds of fake shops as part of this campaign to defraud victims of their money.

• Big Game Sports Betting
  • An update on our findings from this year’s NFL Championship Game in which we talk about our predictions and how they manifested on game day. We will also give in-depth knowledge on our approach to dark web monitoring ahead of major sporting events and the actual attack data we observed. 

When it comes to The Satori Threat Intelligence Team, our customers and bad actors see and feel the results. This is your chance to understand the work behind it.