Bad Traffic / AdHose network injection on Egypt's telecom backbone

On 9 March 2018, the University of Toronto's Citizen Lab published Bad Traffic, revealing that Sandvine PacketLogic deep-packet-inspection (DPI) middleboxes deployed on the network of Telecom Egypt — the country's dominant, state-linked ISP — were being used to covertly hijack ordinary users' web traffic. The same devices redirected Egyptians to affiliate advertising and in-browser cryptocurrency miners, and censored dozens of news and human-rights websites.

What happened

Citizen Lab developed a technical fingerprint for network injection — including an unusual IP-ID value of 13330 and distinctive packet behavior — and matched it to a second-hand Sandvine PacketLogic device purchased and tested in their lab. They then located devices producing that signature on Telecom Egypt's network, at a demarcation point near Marseille, France.

The Egyptian scheme, which researchers named AdHose, ran in two modes. In "spray" mode, the middleboxes redirected large numbers of users to advertisements for short bursts — one January 2018 scan caught it active for 32 minutes, affecting roughly 38% of scanned IPs across 27 Egyptian ASNs. In "trickle" mode, it continuously injected ads into specific URLs and defunct websites, behavior traceable back to at least October 2016. The injected content pushed users toward affiliate ad networks and Coinhive scripts that forced victims' browsers to mine Monero cryptocurrency. The same PacketLogic device also performed censorship via TCP-reset packets, blocking around two dozen sites including Human Rights Watch, Al Jazeera, Reporters Without Borders, and Mada Masr.

Impact

• DPI injection touched users across 17+ Egyptian autonomous systems on Telecom Egypt, plausibly affecting millions of subscribers.
• Affected users were silently turned into revenue generators (ad fraud) and unwitting cryptocurrency miners, with their browsers' compute resources hijacked.
• Independent censorship of major international news and rights organizations restricted Egyptians' access to information.

Attribution

Citizen Lab attributed the technical means to Sandvine PacketLogic devices on Telecom Egypt's infrastructure but did not name the specific operating party. Given that Telecom Egypt is a majority state-owned carrier and the parallel deployment in Turkey was used to deliver government spyware, the report framed the Egyptian activity within a pattern of state-adjacent abuse of commercial DPI hardware. Sandvine publicly disputed the findings and pressured Citizen Lab over a returned demonstration unit.

Why it matters

Bad Traffic exposed how commercial network-management hardware — sold for legitimate traffic shaping — can be repurposed at the ISP backbone to inject malware, run cryptojacking, and censor, all invisibly to end users. The Egyptian AdHose case showed a government-linked carrier monetizing its own subscribers while suppressing critical media, and it intensified scrutiny of the dual-use DPI industry, contributing to Sandvine later facing reputational and policy consequences for sales to authoritarian governments.