Tuesday, October 15, 2024
HomeMalware52,000 Dangerous Command & Control Servers Take Down that Spreading Malware: It...

52,000 Dangerous Command & Control Servers Take Down that Spreading Malware: It Performs 2M Malicious Redirects a Day

Published on

Malware protection

Around 52,000 Malicious Command & Control Severs has been taken down that continuously spreading Malware under well-documented infection chain called EITest.

EITest is a Sophisticated Malware infection chain that basically redirects users from a compromised website into exploit kit (EK) landing pages, social engineering schemes, and potential threats.

Its one of the oldest & largest infection chains, that performed a variety of dangerous infection by distributing ransomware, information stealers, and other malware.

- Advertisement - SIEM as a Service

Recent Years EITest is one of the main sellers of malicious traffic to Exploit Kit (EK) operators and social engineering operations via compromised websites.

Also Read: Cloudflare Launches Spectrum to Protect Almost Entire Internet

EITest Infection History with Exploit Kit

Initially, during the period of 2017 researchers identified that it started using a variety of social engineering tactics and it was redirecting to a private EK known as Glazunov during 2013 and also its stared infecting rework infrastructure in the same year.

Later it directed into Angler Exploit Kit(EK) and the threat actors main motivation to spreading Zaccess Trojan and Glazunov was a private Exploit Kit(EK) used only by the EITest operators.

its reemerged again in 2014 with new infection pattern and started infecting with a new payload with 2 different categories

  • The actor is selling loads (infections) or
  • The actor is selling traffic (to other actors, a load seller, or both)
Accorinding to the Research that conducted by Proofpoint along with brillantit.com and abuse.ch, Based on EITest actor activity on underground forums and insights from Empire Exploit Kit(EK)  we confirmed that the actor was selling traffic. In 2014, we found that the actor was selling traffic in blocks of 50-70,000 visitors for US$20 per thousand, generating between $1,000 and $1,400 per block of traffic.

Recent Main infection chain via EITest mainly for social engineering, tech support scams that lead to eventually infected by the ransomware.

Malicious Servers take down by Sinkholing operation

Researchers create a new domain and Sinkholing (redirection of traffic from its original destination) the EITest operation that has been pointed to a new  IP address.

By generating those new domains, researchers were able to substitute the malicious server with a sinkhole in order to receive the traffic from the backdoors on the compromised websites.

Later they freeing them from the EITest C&Cs and their visitors from the resulting malicious traffic and injects.

The red box highlights the server we substituted with a sinkhole

Researchers analyzing the traffic using this Sinkholing operation and observe that sinkhole received almost 44 million requests from roughly 52,000 servers between  March 15 to April 4, 2018.

Aslo they decoding the malicious request and find the list of compromised domains as well as IP addresses and user agents of the users who had browsed to the compromised servers.

Those compromised websites are multiple content management systems and WordPress websites are the most infected websites.

Indicators of Compromise (IOCs)

IOCIOC TypeDescription
54dfa1cb[.]com|31.184.192.163domain|ipEITest C&C (before sinkholing)
e5b57288[.]com|31.184.192.173domain|ipEITest C&C (before sinkholing)
33db9538[.]com|31.184.192.173domain|ipEITest C&C (before sinkholing)
9507c4e8[.]com|31.184.192.163domain|ipEITest C&C (before sinkholing)
04d92810[.]comdomainEITest Sinkhole
c84c8098[.]comdomainEITest Sinkhole
e42d078d[.]comdomainEITest Sinkhole
498296c9[.]comdomainEITest Sinkhole
stat-dns[.comdomainSeized domain controlling the DGA
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

HORUS Protector Delivering AgentTesla, Remcos, Snake, NjRat Malware

The Horus Protector crypter is being used to distribute various malware families, including AgentTesla,...

ErrorFather Hackers Attacking & Control Android Device Remotely

The Cerberus Android banking trojan, which gained notoriety in 2019 for its ability to...

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

HORUS Protector Delivering AgentTesla, Remcos, Snake, NjRat Malware

The Horus Protector crypter is being used to distribute various malware families, including AgentTesla,...

CoreWarrior Malware Attacking Windows Machines From Dozens Of IP Address

Researchers recently analyzed a CoreWarrior malware sample, which spreads aggressively by creating numerous copies...

TrickMo Malware Targets Android Devices to Steal Unlock Patterns and PINs

The recent discovery of the TrickMo Banking Trojan variant by Cleafy has prompted further...