The Satori Threat Intelligence and Research Team (Satori) is the threat intelligence unit of HUMAN Security, an American cybersecurity company formerly known as White Ops. Formed in 2019, it investigates botnets, online advertising fraud and malvertising, and publishes technical reports on its findings.
Its work, and that of its predecessor researchers at White Ops, has been credited by United States federal prosecutors and the Federal Bureau of Investigation (FBI) in investigations of digital advertising fraud, including the Methbot and 3ve operations and the BADBOX botnets.
History White Ops, the company that later became HUMAN Security, was founded in New York City in 2012 by a team that included the chief executive Michael Tiffany, the chief scientist Dan Kaminsky and the chief technology officer Tamer Hassan, and applied fraud-detection methods developed for banking to the digital advertising market. The company formed the Satori Threat Intelligence and Research Team in February 2020; it said the unit's name was taken from the Japanese Buddhist term satori. White Ops was acquired by a Goldman Sachs-led group in December 2020, renamed itself HUMAN in 2021 and merged with PerimeterX in 2022; the Satori unit continued through each change.
Investigations In December 2016, White Ops, and its then-unnamed threat intelligence team, disclosed Methbot, a video advertising fraud operation that ran on a network of data center servers using hundreds of thousands of leased IP addresses to serve fabricated video advertisements, estimated to generate several million dollars per day. It later worked with Google on a larger operation known as 3ve, which by 2018 was running hidden browsers on more than 1.7 million infected computers.
A 2018 federal indictment charged eight defendants over the two schemes, crediting White Ops and Google with assisting the investigation and takedown; the lead defendant, Aleksandr Zhukov, was convicted in 2021 and sentenced to ten years' imprisonment.
Between 2020 and 2024 the team disclosed a series of advertising fraud operations that abused mobile applications and connected TV devices, among them ICEBUCKET, TERRACOTTA, Pareto, Scylla, VASTFLUX and Konfety; several involved apps removed from the Google Play and Apple app stores after millions of downloads, and some spoofed connected-TV devices to attract higher advertising rates.
In October 2023 Satori disclosed BADBOX, a supply-chain compromise in which tens of thousands of off-brand Android devices were shipped with a firmware backdoor and a linked ad fraud module named PEACHPIT. In March 2025 it disclosed and helped disrupt a larger successor, BADBOX 2.0, which infected around one million consumer devices used for ad fraud and as residential proxies; working with the Shadowserver Foundation, Google and Trend Micro, the team cut off communications for more than 500,000 devices. Germany's Federal Office for Information Security had sinkholed the malware on up to 30,000 devices in December 2024, and in June 2025 the FBI issued a public service announcement (Alert Number: I-060525-PSA) crediting HUMAN Security and its partners; a Google lawsuit the following month described the botnet as the largest known of connected-television devices.
In October 2024, Satori disclosed Phish 'n' Ships, a fraud operation in which more than 1,000 legitimate websites were infected to plant fake listings for hard-to-find products; the listings sent shoppers to 121 fraudulent web stores that abused third-party payment processors to take payment and card details without shipping the goods. The researchers dated the scheme to 2019 and estimated losses of tens of millions of dollars affecting hundreds of thousands of consumers; the fake listings were removed from Google search results and the payment processors closed the operators' accounts.
Later disclosures included SlopAds (September 2025), a ring of 224 Android apps downloaded about 38 million times, and, in 2026, the AI-assisted scareware campaign Pushpaganda and the Android malvertising operation Trapdoor; in each case Google removed the identified apps or updated Google Play Protect in response.
See also Botnet Click fraud Online advertising fraud
References
External links