Categories: Malware

Hackers Abuse Internet-sharing Services to Monetize their Own Malware Campaigns

Recently, it has been reported that the threat actors are discovering new methods to monetize their attacks by exploiting internet-sharing services, or “proxyware” platforms like Honeygain, Nanowire, and many others.

Monetizing their own malware campaigns has brought unusual challenges to different organizations, particularly to those whose internet access is considered private. 

However, we cant say that those who are public are free from this malware, well the report claims that any organization could be in danger, as there are many platforms that enable data center-based internet sharing.

Proxyware

The Proxyware platforms generally allow the users to sell their unused internet bandwidth, and it can be done by running a client application. 

However, the client application is accountable for entering their system into a network, which is being operated by the providers of the platform. Once the providers enter the system then they sell access to this network and routes customer traffic.

And all this is being done via the network, enabling their customers to access the internet utilizing the bandwidth and internet connections that were provided by joints on the network.

There are many proxyware platforms that were emerged recently in this year, and among them here are the popular ones:-

  • Honeygain
  • IPRoyal Pawns
  • Nanowire
  • Peer2Profit
  • PacketStream

Campaigns

According to the investigation report From Cisco Talos, threat actors have used several methods to increase the effectiveness of their malware attacks.

Not only this even during their investigation they came to know about several malware families, that were being distributed under the guise of legitimate installers for applications like Honeygain. 

Apart from this, the malware attempts to leverage victims’ CPU resources for mining cryptocurrency, and not only this but the threat actors are also monetizing their network bandwidth using the proxyware applications.

Trojanized Installers

Trojanized installers are the most common method that has been used by the threat actors during this campaign, and the researchers observed that the threat actors have used the legitimate installers as decoy programs and they also included other malicious components as well. 

However, in these campaigns, the threat actors are spreading malicious executables that pretend to be an installer for legitimate proxyware applications such as Honeygain.

Multi-Payload Monetization

While the analysts at Cisco Talos have also noted that the threat actors are using multiple methods during this campaign for accomplishing the monetizing process.

But, there is some stage that is related to the monetization process, and here we have mentioned them below:-

  • Stage 1: Initial loader
  • Stage 2A: XMRig cryptocurrency miner dropper
  • Stage 2B: Information stealer
  • Stage 2C: Honeygain & Nanowire loader

Apart from this, they have detected malware that was used to install Honeygain on infected systems and register the client along with the adversary’s Honeygain account as it will profit off the victim’s internet bandwidth. 

So, this implies that the threat actor can sign up for different Honeygain accounts as it helps to scale their operation that is based on the number of infected systems under their control.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Hack The box “Ghost” Challenge Cracked – A Detailed Technical Exploit

Cybersecurity researcher "0xdf" has cracked the "Ghost" challenge on Hack The Box (HTB), a premier…

8 hours ago

Sec-Gemini v1 – Google’s New AI Model for Cybersecurity Threat Intelligence

Google has unveiled Sec-Gemini v1, an AI model designed to redefine cybersecurity operations by empowering…

8 hours ago

U.S. Secures Extradition of Rydox Cybercrime Marketplace Admins from Kosovo in Major International Operation

The United States has successfully extradited two Kosovo nationals, Ardit Kutleshi, 26, and Jetmir Kutleshi,…

14 hours ago

Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild

Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect…

2 days ago

Beware! Weaponized Job Recruitment Emails Spreading BeaverTail and Tropidoor Malware

A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how…

2 days ago

EncryptHub Ransomware Uncovered Through ChatGPT Use and OPSEC Failures

EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational…

2 days ago