Tuesday, March 19, 2024

52,000 Dangerous Command & Control Servers Take Down that Spreading Malware: It Performs 2M Malicious Redirects a Day

Around 52,000 Malicious Command & Control Severs has been taken down that continuously spreading Malware under well-documented infection chain called EITest.

EITest is a Sophisticated Malware infection chain that basically redirects users from a compromised website into exploit kit (EK) landing pages, social engineering schemes, and potential threats.

Its one of the oldest & largest infection chains, that performed a variety of dangerous infection by distributing ransomware, information stealers, and other malware.

Recent Years EITest is one of the main sellers of malicious traffic to Exploit Kit (EK) operators and social engineering operations via compromised websites.

Also Read: Cloudflare Launches Spectrum to Protect Almost Entire Internet

EITest Infection History with Exploit Kit

Initially, during the period of 2017 researchers identified that it started using a variety of social engineering tactics and it was redirecting to a private EK known as Glazunov during 2013 and also its stared infecting rework infrastructure in the same year.

Later it directed into Angler Exploit Kit(EK) and the threat actors main motivation to spreading Zaccess Trojan and Glazunov was a private Exploit Kit(EK) used only by the EITest operators.

its reemerged again in 2014 with new infection pattern and started infecting with a new payload with 2 different categories

  • The actor is selling loads (infections) or
  • The actor is selling traffic (to other actors, a load seller, or both)
Accorinding to the Research that conducted by Proofpoint along with brillantit.com and abuse.ch, Based on EITest actor activity on underground forums and insights from Empire Exploit Kit(EK)  we confirmed that the actor was selling traffic. In 2014, we found that the actor was selling traffic in blocks of 50-70,000 visitors for US$20 per thousand, generating between $1,000 and $1,400 per block of traffic.

Recent Main infection chain via EITest mainly for social engineering, tech support scams that lead to eventually infected by the ransomware.

Malicious Servers take down by Sinkholing operation

Researchers create a new domain and Sinkholing (redirection of traffic from its original destination) the EITest operation that has been pointed to a new  IP address.

By generating those new domains, researchers were able to substitute the malicious server with a sinkhole in order to receive the traffic from the backdoors on the compromised websites.

Later they freeing them from the EITest C&Cs and their visitors from the resulting malicious traffic and injects.

The red box highlights the server we substituted with a sinkhole

Researchers analyzing the traffic using this Sinkholing operation and observe that sinkhole received almost 44 million requests from roughly 52,000 servers between  March 15 to April 4, 2018.

Aslo they decoding the malicious request and find the list of compromised domains as well as IP addresses and user agents of the users who had browsed to the compromised servers.

Those compromised websites are multiple content management systems and WordPress websites are the most infected websites.

Indicators of Compromise (IOCs)

IOCIOC TypeDescription
54dfa1cb[.]com|31.184.192.163domain|ipEITest C&C (before sinkholing)
e5b57288[.]com|31.184.192.173domain|ipEITest C&C (before sinkholing)
33db9538[.]com|31.184.192.173domain|ipEITest C&C (before sinkholing)
9507c4e8[.]com|31.184.192.163domain|ipEITest C&C (before sinkholing)
04d92810[.]comdomainEITest Sinkhole
c84c8098[.]comdomainEITest Sinkhole
e42d078d[.]comdomainEITest Sinkhole
498296c9[.]comdomainEITest Sinkhole
stat-dns[.comdomainSeized domain controlling the DGA
Website

Latest articles

CryptoWire Ransomware Attacking Abuses Schedule Task To maintain Persistence

AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in...

E-Root Admin Sentenced to 42 Months in Prison for Selling 350,000 Credentials

Tampa, FL – In a significant crackdown on cybercrime, Sandu Boris Diaconu, a 31-year-old...

WhiteSnake Stealer Checks for Mutex & VM Function Before Execution

A new variant of the WhiteSnake Stealer, a formidable malware that has been updated...

Researchers Hack AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles