article thumbnail

The Link Between AWM Proxy & the Glupteba Botnet

Krebs on Security

AWMproxy, the storefront for renting access to infected PCs, circa 2011. Launched in March 2008, AWM Proxy quickly became the largest service for crooks seeking to route their malicious Web traffic through compromised devices. An example of a cracked software download site distributing Glupteba. Image: Google.com.

Passwords 239
article thumbnail

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

That document indicates the Liberty Reserve account claimed by MrMurza/AccessApproved — U1018928 — was assigned in 2011 to a “ Vadim Panov ” who used the email address lesstroy@mgn.ru. The password chosen by this user was “ 1232.” relied on the passwords asus666 and 01091987h.

Malware 231
article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

has been associated with the user Kerens on the Russian hacking forum Exploit from 2011 to the present day. The very first post by Kerens on Exploit in 2011 was a negative review of a popular crypting service that predated Cryptor[.]biz frequently relied on the somewhat unique password, “ plk139t51z.”

Malware 216