Wednesday, April 24, 2024

Hackers Abuse Internet-sharing Services to Monetize their Own Malware Campaigns

Recently, it has been reported that the threat actors are discovering new methods to monetize their attacks by exploiting internet-sharing services, or “proxyware” platforms like Honeygain, Nanowire, and many others.

Monetizing their own malware campaigns has brought unusual challenges to different organizations, particularly to those whose internet access is considered private. 

However, we cant say that those who are public are free from this malware, well the report claims that any organization could be in danger, as there are many platforms that enable data center-based internet sharing.


The Proxyware platforms generally allow the users to sell their unused internet bandwidth, and it can be done by running a client application. 

However, the client application is accountable for entering their system into a network, which is being operated by the providers of the platform. Once the providers enter the system then they sell access to this network and routes customer traffic.

And all this is being done via the network, enabling their customers to access the internet utilizing the bandwidth and internet connections that were provided by joints on the network.

There are many proxyware platforms that were emerged recently in this year, and among them here are the popular ones:-

  • Honeygain
  • IPRoyal Pawns
  • Nanowire
  • Peer2Profit
  • PacketStream


According to the investigation report From Cisco Talos, threat actors have used several methods to increase the effectiveness of their malware attacks.

Not only this even during their investigation they came to know about several malware families, that were being distributed under the guise of legitimate installers for applications like Honeygain. 

Apart from this, the malware attempts to leverage victims’ CPU resources for mining cryptocurrency, and not only this but the threat actors are also monetizing their network bandwidth using the proxyware applications.

Trojanized Installers

Trojanized installers are the most common method that has been used by the threat actors during this campaign, and the researchers observed that the threat actors have used the legitimate installers as decoy programs and they also included other malicious components as well. 

However, in these campaigns, the threat actors are spreading malicious executables that pretend to be an installer for legitimate proxyware applications such as Honeygain.

Multi-Payload Monetization

While the analysts at Cisco Talos have also noted that the threat actors are using multiple methods during this campaign for accomplishing the monetizing process.

But, there is some stage that is related to the monetization process, and here we have mentioned them below:-

  • Stage 1: Initial loader
  • Stage 2A: XMRig cryptocurrency miner dropper
  • Stage 2B: Information stealer
  • Stage 2C: Honeygain & Nanowire loader

Apart from this, they have detected malware that was used to install Honeygain on infected systems and register the client along with the adversary’s Honeygain account as it will profit off the victim’s internet bandwidth. 

So, this implies that the threat actor can sign up for different Honeygain accounts as it helps to scale their operation that is based on the number of infected systems under their control.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...

Rewards Up to $10 Million for Information on Iranian Hackers

The United States Justice Department has announced big rewards for information leading to the...

PoC Exploit Released For Critical Oracle VirtualBox Vulnerability

Oracle Virtualbox was identified and reported as having a critical vulnerability associated with Privilege...

Tracing the Steps of Cyber Intruders: The Path of Lateral Movement

When cyber attacks strike, it's rarely a single computer that suffers. Nowadays, cybercriminals set...

U.S. to Impose Visa Restrictions on 13 Individuals Involved in Commercial Spyware Operations

To combat the misuse of commercial spyware, the United States Department of State has...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles