Thursday, March 28, 2024

Hackers Abuse Internet-sharing Services to Monetize their Own Malware Campaigns

Recently, it has been reported that the threat actors are discovering new methods to monetize their attacks by exploiting internet-sharing services, or “proxyware” platforms like Honeygain, Nanowire, and many others.

Monetizing their own malware campaigns has brought unusual challenges to different organizations, particularly to those whose internet access is considered private. 

However, we cant say that those who are public are free from this malware, well the report claims that any organization could be in danger, as there are many platforms that enable data center-based internet sharing.

Proxyware

The Proxyware platforms generally allow the users to sell their unused internet bandwidth, and it can be done by running a client application. 

However, the client application is accountable for entering their system into a network, which is being operated by the providers of the platform. Once the providers enter the system then they sell access to this network and routes customer traffic.

And all this is being done via the network, enabling their customers to access the internet utilizing the bandwidth and internet connections that were provided by joints on the network.

There are many proxyware platforms that were emerged recently in this year, and among them here are the popular ones:-

  • Honeygain
  • IPRoyal Pawns
  • Nanowire
  • Peer2Profit
  • PacketStream

Campaigns

According to the investigation report From Cisco Talos, threat actors have used several methods to increase the effectiveness of their malware attacks.

Not only this even during their investigation they came to know about several malware families, that were being distributed under the guise of legitimate installers for applications like Honeygain. 

Apart from this, the malware attempts to leverage victims’ CPU resources for mining cryptocurrency, and not only this but the threat actors are also monetizing their network bandwidth using the proxyware applications.

Trojanized Installers

Trojanized installers are the most common method that has been used by the threat actors during this campaign, and the researchers observed that the threat actors have used the legitimate installers as decoy programs and they also included other malicious components as well. 

However, in these campaigns, the threat actors are spreading malicious executables that pretend to be an installer for legitimate proxyware applications such as Honeygain.

Multi-Payload Monetization

While the analysts at Cisco Talos have also noted that the threat actors are using multiple methods during this campaign for accomplishing the monetizing process.

But, there is some stage that is related to the monetization process, and here we have mentioned them below:-

  • Stage 1: Initial loader
  • Stage 2A: XMRig cryptocurrency miner dropper
  • Stage 2B: Information stealer
  • Stage 2C: Honeygain & Nanowire loader

Apart from this, they have detected malware that was used to install Honeygain on infected systems and register the client along with the adversary’s Honeygain account as it will profit off the victim’s internet bandwidth. 

So, this implies that the threat actor can sign up for different Honeygain accounts as it helps to scale their operation that is based on the number of infected systems under their control.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles