Categories: Malware

Hackers Abuse Internet-sharing Services to Monetize their Own Malware Campaigns

Recently, it has been reported that the threat actors are discovering new methods to monetize their attacks by exploiting internet-sharing services, or “proxyware” platforms like Honeygain, Nanowire, and many others.

Monetizing their own malware campaigns has brought unusual challenges to different organizations, particularly to those whose internet access is considered private. 

However, we cant say that those who are public are free from this malware, well the report claims that any organization could be in danger, as there are many platforms that enable data center-based internet sharing.

Proxyware

The Proxyware platforms generally allow the users to sell their unused internet bandwidth, and it can be done by running a client application. 

However, the client application is accountable for entering their system into a network, which is being operated by the providers of the platform. Once the providers enter the system then they sell access to this network and routes customer traffic.

And all this is being done via the network, enabling their customers to access the internet utilizing the bandwidth and internet connections that were provided by joints on the network.

There are many proxyware platforms that were emerged recently in this year, and among them here are the popular ones:-

  • Honeygain
  • IPRoyal Pawns
  • Nanowire
  • Peer2Profit
  • PacketStream

Campaigns

According to the investigation report From Cisco Talos, threat actors have used several methods to increase the effectiveness of their malware attacks.

Not only this even during their investigation they came to know about several malware families, that were being distributed under the guise of legitimate installers for applications like Honeygain. 

Apart from this, the malware attempts to leverage victims’ CPU resources for mining cryptocurrency, and not only this but the threat actors are also monetizing their network bandwidth using the proxyware applications.

Trojanized Installers

Trojanized installers are the most common method that has been used by the threat actors during this campaign, and the researchers observed that the threat actors have used the legitimate installers as decoy programs and they also included other malicious components as well. 

However, in these campaigns, the threat actors are spreading malicious executables that pretend to be an installer for legitimate proxyware applications such as Honeygain.

Multi-Payload Monetization

While the analysts at Cisco Talos have also noted that the threat actors are using multiple methods during this campaign for accomplishing the monetizing process.

But, there is some stage that is related to the monetization process, and here we have mentioned them below:-

  • Stage 1: Initial loader
  • Stage 2A: XMRig cryptocurrency miner dropper
  • Stage 2B: Information stealer
  • Stage 2C: Honeygain & Nanowire loader

Apart from this, they have detected malware that was used to install Honeygain on infected systems and register the client along with the adversary’s Honeygain account as it will profit off the victim’s internet bandwidth. 

So, this implies that the threat actor can sign up for different Honeygain accounts as it helps to scale their operation that is based on the number of infected systems under their control.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware has…

4 hours ago

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as a…

5 hours ago

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black Banshee,”…

5 hours ago

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear phishing…

5 hours ago

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core Update…

8 hours ago

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by…

9 hours ago