International Scam Ring Uses Russian‑Run Traffic System to Pose as Microsoft Support

Federal investigators and cybersecurity researchers have disclosed a large‑scale fraud network that pretends to be Microsoft technical support, targeting consumers and businesses across multiple countries. The scheme has been active for at least a year, according to the investigators, and appears to have adapted its tactics as security awareness grew.

The operation relies on a malicious traffic distribution system (TDS) that is believed to be operated out of Russia. The TDS routes victims through a chain of compromised web addresses, many of which are hosted on Cloudflare’s content‑delivery network, allowing the scammers to hide their true location and evade detection. By leveraging Cloudflare’s globally distributed edge servers, the scammers can serve malicious payloads from IP addresses that are frequently associated with legitimate traffic, reducing the likelihood of being flagged by traditional security filters.

Scammers initiate contact by cold‑calling or sending phishing emails that claim a Microsoft security breach. Once a potential victim is convinced, they are instructed to download a remote‑access tool that is delivered through the TDS. The tool grants the fraudsters control of the computer, after which they claim to have found “critical” issues and demand payment for bogus repairs. Victims are often told that the alleged malware can only be removed by purchasing a Microsoft‑branded support package, which is paid via prepaid cards or wire transfer, making the funds hard to trace.

According to the analysis released by Dark Reading, the TDS manipulates thousands of Cloudflare‑linked URLs, creating a resilient infrastructure that can quickly replace blocked sites. Researchers noted that the TDS infrastructure is modular; when one set of URLs is taken down, the system automatically redirects traffic to a fresh batch of Cloudflare links, sustaining the campaign with minimal downtime. This scale has enabled the group to siphon millions of dollars from victims, though exact loss figures remain unverified.

Law enforcement agencies in the United States and Europe have opened coordinated investigations, and cybersecurity firms are working with Cloudflare to identify and disable the abusive links. Cloudflare has stated that it is actively reviewing the traffic patterns and will terminate services for any accounts found to be facilitating illicit activity. In addition to the ongoing investigations, a joint advisory has been issued urging organizations to monitor outbound connections for patterns indicative of TDS usage and to implement stricter controls on remote‑access software.

The discovery underscores the growing sophistication of tech‑support scams and the challenges of policing the open internet. Experts warn that users should verify any unsolicited Microsoft support offers through official channels and that continued collaboration between industry and authorities will be essential to dismantle similar operations in the future. As the investigation proceeds, authorities expect to seek extradition of the Russian operators and to pursue legal action against any domestic accomplices who facilitate the link abuse.