A new Infoblox Threat Intelligence (ITI) report, developed in collaboration with the United Nations Office on Drugs and Crime (UNODC), suggests that BBIN (also known as the Baoying Group)—one of Asia’s largest iGaming and online casino platform providers—may be connected to cyber-enabled fraud schemes, illegal gambling operations, and organized crime activities across Southeast Asia.
According to the research, a central component of this alleged operation is the Universe Browser, a tool marketed as a privacy browser for online gamblers looking to bypass restrictions or regional censorship. However, ITI analysts state that the browser may be capable of stealth surveillance, credential harvesting, and remote access, posing serious risks to users and business networks.
ITI refers to this network of interconnected corporate entities, technology infrastructure, and criminal activity as “Vault Viper.” The group is allegedly centered around BBIN and is estimated to be worth tens of millions of dollars. Researchers assert that Vault Viper is responsible for developing and distributing the Universe Browser.
Infrastructure Findings
Through advanced DNS traffic analysis, Infoblox uncovered tens of thousands of domains believed to be tied to Vault Viper’s network. The domains share a unique DNS fingerprint, indicating large-scale centralized control and suggesting the group operates its own Autonomous System Number (ASN) and multiple large businesses across several countries.
Privacy Claims vs. Security Risks:
The Universe Browser is promoted as a privacy-enhancing tool but may have the capacity to silently install software associated with monitoring user activity, stealing login credentials, or enabling remote system access.
Extensive Global Infrastructure:
The network allegedly spans tens of thousands of domains connected through a distinct DNS pattern. ITI researchers tracked these systems across corporate structures, hosting environments, and global IP networks.
Connection to Commercial Enterprises:
The report notes significant overlap between Vault Viper activity and BBIN / Baoying Group, which has links to businesses ranging from online casinos and digital platforms to airlines and IT service companies. The research traces these connections back over two decades.
Continued Operations Despite Regional Bans:
Even after offshore gambling restrictions were strengthened in the Philippines, the network is believed to still be operating from Cambodia, supporting unregulated casino and iGaming platforms.
The report emphasizes that Vault Viper represents more than just a cybersecurity issue—it highlights the evolving intersection of cybercrime, online gambling, and international organized crime networks. By making its findings public, Infoblox aims to support law enforcement, cybersecurity professionals, financial institutions, and everyday internet users in identifying and defending against emerging digital threats tied to large-scale criminal enterprises.
