> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Russian traffer teams launch AI-assisted fraud kits targeting prediction markets - URL: https://f4n6.co.uk/security-feed/russian-traffer-teams-launch-ai-assisted-fraud-kits-targeting-prediction-markets/ - Published: 2026-10-29T18:41:51.000Z - Updated: 2026-10-29T18:41:51.000Z - Author: Jeff Davies - Tags: #security-feed, AtlasCore, PolyFucked, Magnetic Team ## 1\. Executive summary Insikt Group (Recorded Future) reports that three Russian-language traffer teams, AtlasCore, PolyFucked and Magnetic Team, have since spring 2026 adapted affiliate fraud kits to prediction markets such as Polymarket and Kalshi, supplying affiliates with simulated trading sites, administrative panels, crypto payment rails and AI-assisted victim support. The kits combine fabricated market activity, operator-controlled win/loss outcomes and configurable withdrawal blocks to keep deposited funds, and the victim-facing pages collect card details (number, holder, expiry, CVV) plus passport, ID-card and driving-licence images under a fake KYC process. No CVE, CVSS score, EPSS value or CISA KEV entry applies: this is a fraud-as-a-service campaign, not a software vulnerability, and none of the three named teams has a MITRE ATT&CK profile, so all attribution is unconfirmed. EMEA financial services exposure is indirect but concrete: card-not-present and crypto on-ramp fraud, synthetic-influencer promotion on Instagram, Threads and YouTube, and identity-document harvesting that can feed account-opening fraud. The claimed figures ($10.97m AtlasCore deposits, $2.4m PolyFucked quarterly turnover, 3,000+ simulated traders) are self-reported by the actors and unverified. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | Affiliates depend on third-party infrastructure named in the source (Cloudflare-fronted domains, mobile proxies from luxproxy\[.\]cc, proxy-store\[.\]cc and proxy-seller\[.\]com, NanoGPT API keys) that a firm's own fraud tooling or marketing-fraud vendors may also touch | Review ICT third-party contracts and monitoring for any dependency on these providers; confirm fraud-analytics vendors flag prediction-market domains | | NIS2 Art. 21(2)(d) | The fraud kits harvest identity documents and card data that flow into the supply chain of KYC and payment providers a firm relies on | Assess supply chain security measures for KYC and card-processing providers against document-forgery and synthetic-identity risk | No other article in the reference is engaged by the facts here. UK NIS 2018 duties are not triggered by a fraud campaign with no incident against an OES/RDSP. ## 3\. Technical analysis & attack chain The operation is a fraud-as-a-service model. Each team supplies the platform, the payment infrastructure and the promotional playbook; the affiliate supplies a domain and traffic and keeps 60% to 80% of victim deposits. The confirmed steps, as described by Insikt Group: 1. Affiliate applies through a Telegram bot (@AtlasCoreTeam\_bot, @AtlasCorePolymarket\_bot, @PolyFuckedBot) and receives credentials to a shared administrative panel. AtlasCore hosts the panel at atlascore-panel\[.\]net with sub-teams at polymarket\[.\]atlascore-panel\[.\]net and casino\[.\]atlascore-panel\[.\]net. 2. Affiliate registers a domain or uses a shared one (prdct\[.\]cc, event-x\[.\]cc, predicate\[.\]cc, predicate\[.\]club, predictum\[.\]app and others), typically fronted by Cloudflare. 3. The fake site presents a Polymarket-style interface: YES/NO event wagering, displayed probabilities, trading volume, liquidity and live activity. AtlasCore code imports data from the public Polymarket API to mimic real market movement. 4. The affiliate drives traffic with AI-generated synthetic influencers. AtlasCore manuals direct affiliates to Nano-GPT and image models to blend two real people's photographs into a persistent synthetic identity, then generate photos and short videos of that persona reacting to trending geopolitical and crypto events, published as Instagram Reels with event hashtags. Manuals instruct removal of metadata before upload to avoid AI-content labelling. 5. Victims deposit crypto. AtlasCore's "Депозиты" Telegram channel (t\[.\]me/+N\_juj1e38-U1Mzlh) broadcasts deposits, majority in BTC. 6. The operator manipulates outcomes. AtlasCore code exposes a win-chance setting where 0 means "always lose" and 100 means "always win", applied globally or per victim. Magnetic Team code exposes forced-loss controls and pools of up to 20,000 deposit wallets per blockchain. 7. Withdrawal is blocked. AtlasCore code ships WithdrawErrorModal, WithdrawModal and MamontWithdrawErrorBlock components with configurable, victim-specific withdrawal-error text, plus operator-set deposit, trade and withdrawal fees and minimum deposits. Magnetic Team exposes configurable withdrawal-blocking pretexts. 8. The victim interface harvests card number, cardholder name, expiry and CVV, and runs a fake KYC collecting passport, identity card or driving-licence images (both sides) and a selfie with each document. 9. AI handles victim support. AtlasCore guidance has operators buy a NanoGPT key and auto-send support replies under an operator persona, recommending GPT-4o or Claude Sonnet 4 for context retention and cheaper models (GPT-4o Mini, Gemini 2.0 Flash, DeepSeek Chat) for translating victim messages into Russian. A secondary model from another provider is used when the primary refuses. The API key is stored server-side. The code internally labels victims "mamont" (mammoth), the Russian fraud-community slang the manuals also use. Insikt Group identified over 100 domains and subdomains across the three teams, plus JavaScript files such as /build/assets/app-Ch74MqWt.js and /build/assets/app-DwKjOmEK.js used by predicate\[.\]cc. Confidence caveats. All three team names lack a MITRE ATT&CK profile; treat attribution as unconfirmed. The dollar figures and trader/market counts are actor self-reporting and unverified. The assessment that Magnetic Team's code shows AI-assisted development is explicitly unconfirmed by Insikt Group. The link between predicate\[.\]club's hosting IP 192\[.\]162\[.\]199\[.\]243 and AtlasCore is described as a possible connection based on co-hosted casino, exchange and prediction-market domains. The full domain and IP lists sit in the report's Appendices A and B, which were not supplied here. ## 4\. Mitigation & containment P1 within 24h - Block the named domains at web proxy and DNS: prdct\[.\]cc, event-x\[.\]cc, predicate\[.\]cc, predicate\[.\]club, predicate\[.\]world, predicate\[.\]live, predictedby\[.\]cc, predictum\[.\]app, predictum\[.\]pro, predictum\[.\]cc, atlascore-panel\[.\]net and its subdomains, and the co-hosted speculor\[.\]net, rqwrujarser\[.\]icu, wettora\[.\]com, bravioar\[.\]com, winzo\[.\]live. Single-sourced to Insikt Group; verify before enforcement. - Add card-not-present rules for merchant descriptors tied to these domains and flag any transaction where the merchant is a prediction-market site not on the approved list. - Brief fraud and AML teams on the fake-KYC pattern: passport/ID/driving-licence images plus selfie submitted to a non-bank platform, which can reappear in account-opening attempts. P2 within 72h - Screen onboarding and existing customers for identity documents whose provenance traces to these platforms; escalate to enhanced due diligence where a document matches a known harvested set. - Add social-media monitoring for synthetic influencer accounts promoting prediction markets, using the Reels-plus-event-hashtag pattern and metadata-stripped imagery as signals. - Review any marketing or affiliate partnerships that reference prediction markets for legitimacy. P3 within 7 days - Update fraud-analytics vendor feeds to include the domain set and request coverage confirmation. - Tabletop the document-harvesting scenario against your KYC provider's forgery detection. No vendor patch exists; this is not a vulnerability. Containment is domain blocking, transaction monitoring and identity-fraud controls. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | ------------------------------------------- | ---------- | -------------------------------------- | | domain | prdct\[.\]cc | medium | Insikt Group | | domain | event-x\[.\]cc | medium | Insikt Group | | domain | predicate\[.\]cc | medium | Insikt Group | | domain | predicate\[.\]club | medium | Insikt Group | | domain | predicate\[.\]world | medium | Insikt Group | | domain | predicate\[.\]live | medium | Insikt Group | | domain | predictedby\[.\]cc | medium | Insikt Group | | domain | predictum\[.\]app | medium | Insikt Group | | domain | predictum\[.\]pro | medium | Insikt Group | | domain | predictum\[.\]cc | medium | Insikt Group | | domain | atlascore-panel\[.\]net | medium | Insikt Group | | domain | polymarket\[.\]atlascore-panel\[.\]net | medium | Insikt Group | | domain | casino\[.\]atlascore-panel\[.\]net | medium | Insikt Group | | domain | docs\[.\]atlascore-panel\[.\]net | medium | Insikt Group | | domain | testdomainatlas\[.\]com | medium | Insikt Group | | domain | speculor\[.\]net | low | Insikt Group (possible AtlasCore link) | | domain | rqwrujarser\[.\]icu | low | Insikt Group (possible AtlasCore link) | | domain | wettora\[.\]com | low | Insikt Group (possible AtlasCore link) | | domain | bravioar\[.\]com | low | Insikt Group (possible AtlasCore link) | | domain | winzo\[.\]live | low | Insikt Group (possible AtlasCore link) | | ipv4 | 192\[.\]162\[.\]199\[.\]243 | low | Insikt Group (possible AtlasCore link) | | url | hxxps://t\[.\]me/+N\_juj1e38-U1Mzlh | medium | Insikt Group | | email | austinhenderson199962\[@\]quickblox\[.\]net | low | Insikt Group (open-source association) | | filepath | /build/assets/app-Ch74MqWt.js | medium | Insikt Group | | filepath | /build/assets/app-DwKjOmEK.js | medium | Insikt Group | ```iocs domain prdct[.]cc domain event-x[.]cc domain predicate[.]cc domain predicate[.]club domain predicate[.]world domain predicate[.]live domain predictedby[.]cc domain predictum[.]app domain predictum[.]pro domain predictum[.]cc domain atlascore-panel[.]net domain polymarket[.]atlascore-panel[.]net domain casino[.]atlascore-panel[.]net domain docs[.]atlascore-panel[.]net domain testdomainatlas[.]com domain speculor[.]net domain rqwrujarser[.]icu domain wettora[.]com domain bravioar[.]com domain winzo[.]live ipv4 192[.]162[.]199[.]243 url hxxps://t[.]me/+N_juj1e38-U1Mzlh email austinhenderson199962[@]quickblox[.]net filepath /build/assets/app-Ch74MqWt.js filepath /build/assets/app-DwKjOmEK.js ``` All indicators are single-sourced to Insikt Group; verify before enforcement. No file hashes were supplied in the material provided. ## 6\. Detection The source gives distinctive code artefacts (component names, the "mamont" label, the win-chance semantics) usable in a YARA rule against the JavaScript bundles. The Sigma rule targets the WebSocket connection to the panel and the domain pattern. ```yara rule Traffer_PredictionMarket_JS_AtlasCore { meta: author = "Adverse Trace" date = "2026-10-29" reference = "https://www.recordedfuture.com/research/prediction-markets-traffer-teams" description = "Detects AtlasCore-style fake prediction market JavaScript bundles by component and victim-label artefacts" strings: $c1 = "WithdrawErrorModal" $c2 = "WithdrawModal" $c3 = "MamontWithdrawErrorBlock" $c4 = "mamont" $c5 = "always lose" $c6 = "always win" condition: uint32(0) != 0x04034b50 and 3 of them } ``` ```yaml title: WebSocket Connection to AtlasCore Prediction Market Panel id: 7b3e9c2a-atlas-pm-2026 status: experimental description: Detects browser or host network connections to the AtlasCore prediction market panel subdomain author: Adverse Trace date: 2026/10/29 references: - https://www.recordedfuture.com/research/prediction-markets-traffer-teams logsource: category: proxy detection: selection_domain: DestinationHostname|endswith: - 'polymarket.atlascore-panel.net' - 'atlascore-panel.net' selection_ws: Protocol: 'websocket' condition: selection_domain fields: - DestinationHostname - Protocol - SourceIp falsepositives: - None expected; domain is threat-actor controlled level: high ``` ## 7\. Sources - Recorded Future / Insikt Group, "Prediction Markets Emerge as a New Vertical for Traffers Teams", https://www.recordedfuture.com/research/prediction-markets-traffer-teams, 2026-10-29. ## 8\. Adverse Trace position This is a fraud-as-a-service campaign with no CVE, no CVSS score, no EPSS value and no CISA KEV entry, so severity is assessed on fraud and identity impact rather than vulnerability scoring. The named teams have no MITRE ATT&CK profile and attribution is unconfirmed; the financial figures are actor self-reporting. Client impact concentrates in card-not-present fraud, crypto on-ramp abuse and identity-document harvesting that can resurface in account-opening and KYC processes, with a secondary exposure through third-party providers named in the kits. Adverse Trace will monitor for the full domain and IP lists in the report's Appendices A and B, track whether the prediction-market theme spreads to additional traffer teams, and issue an update if corroborating sources confirm the AtlasCore infrastructure links currently resting on a single report. Clients should treat the domain set as single-sourced and verify before enforcement. --- [Read the original source →](https://www.recordedfuture.com/research/prediction-markets-traffer-teams?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*