#amadey

Cybersecurity is an endless war. As long as there are users there will also be threat actors. As long as there is software, there will be those who manipulate and exploit it. There will never be a time when the internet is fully ‘safe’ from threats, no matter how many domains are taken down, how many disruptions are carried out. That doesn’t mean we should fail to acknowledge a win when we get one, though.

Yesterday, with cooperation with Europol and other industry partners as part of Operation Endgame, Microsoft’s Digital Crimes Unit carried out an operation resulting in the takedown, suspension, and blocking of domains and command-and-control (C2) servers that formed the backbone of StealC and Amadey infrastructure (source: Microsoft Threat Intelligence). Together they identified over 200 malicious Amadey and StealC command-and-control domains and IPs and moved to shut them down through a mix of court orders, domain seizures, registrations, and provider notifications. StealC is a fairly well known family of malware-as-a-service. Amadey is a modular loader, the vehicle by which malware like StealC is delivered.

To understand the importance of a disruption like this, one must understand why it matters. In recent months, we’ve been bombarded with large scale, high profile data breaches, often going after links in the supply chain to execute attacks. Salesforce, Oracle’s PeopleSoft and more recently the ErrTraffic campaign are all supply chain hacks, relying either on vulnerabilities in development packages or outright brute force theft of login credentials. There have been widespread downstream effects of these hacks, notably in how much of the data stolen – both directly related and accessed through pivoting into connected enterprises – has ended up exposed when extortion fails. Infostealers are a little different. The goal isn’t necessarily to extort the victim but to sell the data to the highest bidder. Trojan malware works by obfuscating itself, leaving the victim unaware of its presence until it’s too late. Which in turn means that many of them don’t change their credentials because they don’t know they should. The stolen data remains viable.

StealC is opportunistic in nature, mostly distributed through malvertising, although ClickFix versions are readily available. Users tend to want the free download over paying for it, and the ClickFix technique fills that niche, offering anything from allegedly ‘cracked’ popular software to gaming cheats to search engine optimization (SEO) poisoning (which is where search results are injected with false, hijacked or compromised entries). Phishing emails are also a vector for this kind of malware, tricking users into downloading something infected. From there, the malware scrapes and exfiltrates everything it can reach, returning the data to the C2 operator, who then sells it. Stealers are a link in their own form of the supply chain. Given the number of C2 domains, rather typical for these kinds of threat actors, one can see how difficult it is to disrupt the chain as a whole. When one domain gets taken down, they simply shift to another one. It’s why operations like this take such coordination to strike all of them at once. And why there is such an emphasis on hardening security with MFA, credential hygiene and general education regarding these intrusions.

Among the very first reports I published was on the takedown and subsequent return of LummaStealer, which had also been subject to disruption. In a matter of weeks, it was back. That said, the disruption wasn’t pointless by any means. LummaStealer has faded somewhat into the background, either because the current C2 domains have not returned in strength or because the kinds of threat actors that use it are wary of being caught. I’m sure it’s still out there, and malicious operators are still using it. It could very well be that due to higher profile cases being reported on, it’s simply slipping through the cracks of visibility. Cybersecurity is an endless war. I have no doubt that despite the success of this disruption by Microsoft, we haven’t seen the last of StealC either. But for now, let us celebrate a rare win.

A previously undocumented proxy botnet called Socks5Systemz is being distributed via PrivateLoader and Amadey malware loaders to infect computers worldwide. According to researchers, the botnet has been around since 2016 but remained under the radar only to be discovered recently.  Since October, Socks5Systemz has infected approximately 10,000 systems across the globe, including India, Brazil,…

Exploit Kits Target Windows Users with Ransomware and Trojans

Over the weekend and into today, four different malvertising campaigns have been redirecting users to exploit kits that install password stealing Trojans, ransomware, and clipboard hijackers.

All four of these campaigns were discovered by exploit kit expert nao_secand are being distributed through malvertising that redirect visitors to the exploit kits landing pages. These landing pages are…