The Group Theory Inside Bedep's DGA
Essential information
- Published
- 22/04/2026 22:57
- Modified
- 27/04/2026 14:36
- Tags
- 2026-04-22 CVE-2015-0311 ad-fraud botnet angler angler exploit kit bedep cyclic groups dga domain generation algorithm foreign exchange rates group theory
- Related entities
- 1 vulnerabilities (cve), 1 observables, 16 techniques (mitre), 2 malware, 2 others
Description
Bedep was an ad-fraud botnet active from late 2014 through 2015, delivered through the Angler exploit kit. It employed an unusually sophisticated domain generation algorithm that used real foreign exchange rates from the European Central Bank combined with advanced group theory mathematics to generate command-and-control domains. Unlike typical DGAs that rely solely on date-based seeds, Bedep's algorithm fetched currency exchange rates and UTC timestamps from legitimate public sources, making future domains unpredictable until the data was published. The malware implemented mathematical concepts including cyclic groups, primitive root generators, and modular arithmetic to ensure collision-free domain generation. This unique approach made it significantly harder for defenders to pre-compute and block domains compared to conventional DGAs, as the exchange rates couldn't be predicted in advance.