Advertising, Hacking, Malware and Web Fraud

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

JUNE 21, 2023

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. This story explores the history and identity behind Cryptor[.]biz WHO RUNS CRYPTOR[.]BIZ?

Malware

Malware Antivirus Cybercrime Hacking

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

APRIL 18, 2023

For the past seven years, a malware-based proxy service known as “ Faceless ” has sold anonymity to countless cybercriminals. For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised on the service. Image: spur.us.

Malware

Malware Passwords Accountability Advertising

15-Year-Old Malware Proxy Network VIP72 Goes Dark

Krebs on Security

SEPTEMBER 1, 2021

Over the past 15 years, a cybercrime anonymity service known as VIP72 has enabled countless fraudsters to mask their true location online by routing their traffic through millions of malware-infected systems. Between 2003 and 2006, Corpse focused on selling and supporting his Haxdoor malware. Image: Google Translate via Archive.org.

Malware

Malware Cybercrime Internet Internet

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies.

Malware

Malware VPN Internet Internet

No SOCKS, No Shoes, No Malware Proxy Services!

Krebs on Security

AUGUST 2, 2022

With the recent demise of several popular “proxy” services that let cybercriminals route their malicious traffic through hacked PCs, there is now something of a supply chain crisis gripping the underbelly of the Internet. com , a malware-based proxy network that has been in existence since at least 2010. Image: Spur.us.

Malware

Malware Cybercrime Internet Internet

Using Google Search to Find Software Can Be Risky

Krebs on Security

JANUARY 25, 2024

But cybercrooks are constantly figuring out ingenious ways to fly beneath Google’s anti-abuse radar, and new examples of bad ads leading to malware are still too common. My guess it’s still continuing because of the up-and-down [of the] domains hosting malware and then looking legitimate.” million advertiser accounts.

Software

Software Advertising Malware Accountability

Who and What is Behind the Malware Proxy Service SocksEscort?

Security Boulevard

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. The post Who and What is Behind the Malware Proxy Service SocksEscort?

Malware

Malware Small Business Internet Internet

Malicious Office 365 Apps Are the Ultimate Insiders

Krebs on Security

MAY 5, 2021

After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free access to any of the user’s emails and files, both of which are then plundered to launch malware and phishing scams against others. Image: Proofpoint.

Accountability

Accountability Passwords Advertising Phishing

‘The Manipulaters’ Improve Phishing, Still Fail at Opsec

Krebs on Security

APRIL 3, 2024

In May 2015, KrebsOnSecurity published a brief writeup about the brazen Manipulaters team, noting that they openly operated hundreds of web sites selling tools designed to trick people into giving up usernames and passwords, or deploying malicious software on their PCs. ” A number of questions, indeed.

Phishing

Phishing Cybercrime Malware Advertising

The Link Between AWM Proxy & the Glupteba Botnet

Krebs on Security

JUNE 28, 2022

On December 7, 2021, Google announced it was suing two Russian men allegedly responsible for operating the Glupteba botnet, a global malware menace that has infected millions of computers over the past decade. PPI programs) to generate new installations of their malware.”

Passwords

Passwords Malware Internet Internet

Interview With a Crypto Scam Investment Spammer

Krebs on Security

MAY 22, 2023

Since then, the same spammers have used this method to advertise more than 100 different crypto investment-themed domains. In September 2018, a user by the name “ ципа ” (phonetically “ Zipper ” in Russian) registered on the Russian hacking forum Lolzteam using the edgard0111012@gmail.com address.

Scams

Scams DDOS Cryptocurrency Accountability

Who’s Behind the Botnet-Based Service BHProxies?

Krebs on Security

FEBRUARY 24, 2023

The Mylobot malware includes more than 1,000 hard-coded and encrypted domain names, any one of which can be registered and used as control networks for the infected hosts. The service is currently advertising access to more than 150,000 devices globally. WHO’S BEHIND BHPROXIES? The website BHProxies[.]com

Accountability

Accountability Advertising Marketing Malware

A Deep Dive Into the Residential Proxy Service ‘911’

Krebs on Security

JULY 18, 2022

re network uses at least two free VPN services to lure its users to install a malware-like software that achieves persistence on the user’s computer,” the researchers wrote. The Exe Clean service made malware look like goodware to antivirus products. The Exe Clean service made malware look like goodware to antivirus products.

VPN

VPN Computers and Electronics Antivirus Software

Phishers are Angling for Your Cloud Providers

Krebs on Security

AUGUST 30, 2019

But when accounts at those CRM providers get hacked or phished, the results can be damaging for both the client’s brand and their customers. On August 21, multiple United Rental customers reported receiving invoice emails with booby-trapped links that led to a malware download for anyone who clicked.

Phishing

Phishing Marketing Accountability DNS

‘Spam Nation’ Villain Vrublevsky Charged With Fraud

Krebs on Security

MARCH 22, 2022

A Google-translated snippet of the hacked ChronoPay Confluence installation. The latest document in the hacked archive is dated April 2021. ” A native of Donetsk, Ukraine, Horohorin told KrebsOnSecurity he hacked and shared the ChronoPay Confluence installation because Vrublevsky had threatened a family member.

Banking

Banking Marketing DDOS Risk

How to Shop Online Like a Security Pro

Krebs on Security

NOVEMBER 23, 2018

Adopting a shopping strategy of simply buying from the online merchant with the lowest advertised prices can be a bit like playing Russian Roulette with your wallet, for the simple reason that there are tons of completely fake e-commerce sites out there looking to separate the unwary from their credit card details. CHCEK THE SHIPPING.

Scams

Scams Wireless Phishing Banking

How Cybercriminals are Weathering COVID-19

Krebs on Security

APRIL 30, 2020

In many ways, the COVID-19 pandemic has been a boon to cybercriminals: With unprecedented numbers of people working from home and anxious for news about the virus outbreak, it’s hard to imagine a more target-rich environment for phishers, scammers and malware purveyors.

Cybercrime

Cybercrime Computers and Electronics Marketing Scams

Amid an Embarrassment of Riches, Ransom Gangs Increasingly Outsource Their Work

Krebs on Security

OCTOBER 8, 2020

Each day, millions of malware-laced emails are blasted out containing booby-trapped attachments. From there, the infected system will report home to a malware control server operated by the spammers who sent the missive. ” WHO IS DR. SAMUIL? The domain registration records for ruskod[.]net

Cybercrime

Cybercrime VPN Malware Penetration Testing

Crafty Web Skimming Domain Spoofs “https”

Krebs on Security

MARCH 11, 2020

Earlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that one of its Web sites had been hacked and retrofitted with code that steals credit card and login data. A script that references an external JavaScript, hosted on a malicious site (in this case, http[.]ps).

Retail

Retail Hacking Advertising Web Fraud

Meet the World’s Biggest ‘Bulletproof’ Hoster

Krebs on Security

JULY 16, 2019

For at least the past decade, a computer crook variously known as “ Yalishanda ,” “ Downlow ” and “ Stas_vl ” has run one of the most popular “bulletproof” Web hosting services catering to a vast array of phishing sites, cybercrime forums and malware download servers.

Cybercrime

Cybercrime Phishing Banking Malware

Cyber Security Informer

Why Malware Crypting Services Deserve More Scrutiny

Giving a Face to the Malware Proxy Service ‘Faceless’

Trending Sources

15-Year-Old Malware Proxy Network VIP72 Goes Dark

Who and What is Behind the Malware Proxy Service SocksEscort?

No SOCKS, No Shoes, No Malware Proxy Services!

Using Google Search to Find Software Can Be Risky

Who and What is Behind the Malware Proxy Service SocksEscort?

Malicious Office 365 Apps Are the Ultimate Insiders

‘The Manipulaters’ Improve Phishing, Still Fail at Opsec

The Link Between AWM Proxy & the Glupteba Botnet

Interview With a Crypto Scam Investment Spammer

Who’s Behind the Botnet-Based Service BHProxies?

A Deep Dive Into the Residential Proxy Service ‘911’

Phishers are Angling for Your Cloud Providers

‘Spam Nation’ Villain Vrublevsky Charged With Fraud

How to Shop Online Like a Security Pro

How Cybercriminals are Weathering COVID-19

Amid an Embarrassment of Riches, Ransom Gangs Increasingly Outsource Their Work

Crafty Web Skimming Domain Spoofs “https”

Meet the World’s Biggest ‘Bulletproof’ Hoster

Stay Connected