Categories: Malware

Hackers Abuse Internet-sharing Services to Monetize their Own Malware Campaigns

Recently, it has been reported that the threat actors are discovering new methods to monetize their attacks by exploiting internet-sharing services, or “proxyware” platforms like Honeygain, Nanowire, and many others.

Monetizing their own malware campaigns has brought unusual challenges to different organizations, particularly to those whose internet access is considered private. 

However, we cant say that those who are public are free from this malware, well the report claims that any organization could be in danger, as there are many platforms that enable data center-based internet sharing.

Proxyware

The Proxyware platforms generally allow the users to sell their unused internet bandwidth, and it can be done by running a client application. 

However, the client application is accountable for entering their system into a network, which is being operated by the providers of the platform. Once the providers enter the system then they sell access to this network and routes customer traffic.

And all this is being done via the network, enabling their customers to access the internet utilizing the bandwidth and internet connections that were provided by joints on the network.

There are many proxyware platforms that were emerged recently in this year, and among them here are the popular ones:-

  • Honeygain
  • IPRoyal Pawns
  • Nanowire
  • Peer2Profit
  • PacketStream

Campaigns

According to the investigation report From Cisco Talos, threat actors have used several methods to increase the effectiveness of their malware attacks.

Not only this even during their investigation they came to know about several malware families, that were being distributed under the guise of legitimate installers for applications like Honeygain. 

Apart from this, the malware attempts to leverage victims’ CPU resources for mining cryptocurrency, and not only this but the threat actors are also monetizing their network bandwidth using the proxyware applications.

Trojanized Installers

Trojanized installers are the most common method that has been used by the threat actors during this campaign, and the researchers observed that the threat actors have used the legitimate installers as decoy programs and they also included other malicious components as well. 

However, in these campaigns, the threat actors are spreading malicious executables that pretend to be an installer for legitimate proxyware applications such as Honeygain.

Multi-Payload Monetization

While the analysts at Cisco Talos have also noted that the threat actors are using multiple methods during this campaign for accomplishing the monetizing process.

But, there is some stage that is related to the monetization process, and here we have mentioned them below:-

  • Stage 1: Initial loader
  • Stage 2A: XMRig cryptocurrency miner dropper
  • Stage 2B: Information stealer
  • Stage 2C: Honeygain & Nanowire loader

Apart from this, they have detected malware that was used to install Honeygain on infected systems and register the client along with the adversary’s Honeygain account as it will profit off the victim’s internet bandwidth. 

So, this implies that the threat actor can sign up for different Honeygain accounts as it helps to scale their operation that is based on the number of infected systems under their control.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Pathfinder AI – Hunters Announces New AI Capabilities for Smarter SOC Automation

Pathfinder AI expands Hunters' vision for AI-driven SOCs, introducing Agentic AI for autonomous investigation and…

1 hour ago

Google Secretly Tracks Android Devices Even Without User-Opened Apps

A recent technical study conducted by researchers at Trinity College Dublin has revealed that Google…

2 hours ago

LLMjacking – Hackers Abuse GenAI With AWS NHIs to Hijack Cloud LLMs

In a concerning development, cybercriminals are increasingly targeting cloud-based generative AI (GenAI) services in a…

2 hours ago

Microsoft Strengthens Trust Boundary for VBS Enclaves

Microsoft has introduced a series of technical recommendations to bolster the security of Virtualization-Based Security…

3 hours ago

Hackers Exploiting Business Relationships to Attack Arab Emirates Aviation Sector

A sophisticated cyber espionage campaign targeting the aviation and satellite communications sectors in the United…

3 hours ago

Microsoft Removing DES Encryption from Windows 11 24H2 and Windows Server 2025″

Microsoft has announced the removal of the Data Encryption Standard (DES) encryption algorithm from Kerberos…

3 hours ago