#ghost network

YouTube is often informational, generally entertaining and is widely used for both. It’s simple to use, both as a viewer and an uploader, which is how it’s also become a hotbed of misinformation, deepfake generative-AI media and phishing campaigns.

Check Point Research has uncovered over 3,000 malicious videos linked to what is being called the YouTube Ghost Network, a malware distribution campaign. According to the report, the Ghost Network has been in operation since 2021, although this year has seen an exponential increase in uploads. The videos are usually promoted as gaming hacks and cracked software codes, two popular targets for social engineering, and unleash info-stealers into compromised accounts.

The Ghost Network operates on a threefold operational model: video uploaders, post publishers, and interaction boosters. The malicious videos are hosted by the uploader accounts; they are the front facing bait of the campaign, and are the first step to infection by instructing users to disable their Windows Defender before installing them. The post account publish ‘community updates’ that contain the links to the malware hosted on a secondary site like Dropbox or Google Drive. Interaction boosters create fake reviews and positive comments to engender trust in the ‘product’. Combined, this is a perfect example of how social engineering works. People love a popular thing, and are willing to put their trust in it without question if they see others doing so.

A sophisticated evasion technique is in play as well, sharing download links with passwords to bypass anti-virus software, or they’re embedded in the comments or video walkthroughs. This is not a brute force attack, but rather a campaign that entices users to do the infecting themselves.

Lumma, previously the most common payload of the infection, was disrupted earlier this year, and has since fallen from popularity in this particular campaign. The threat actors are now frequently using Rhadamanthys, with a rotation of command-and-control servers to avoid detection. HijackLoader has also been seen in a version promoting a fake Adobe Photoshop installer. All of them are stealing credentials and browser data from their victims.

This campaign, while actively being reduced by Check Point’s takedown, is still ongoing. Some of the malicious videos have hundreds of thousands of views on them, making them susceptible to algorithmic filtering and thus easier to find. This is my periodic reminder to never click an untrusted link, never disable security features while installing anything and come ask your friendly neighborhood WISP for help if you get into trouble.

The networks claim to have providers, but they’re padded with practitioners who are no longer in the network, not taking new patients, or who have retired.

This seems like it could be a type of fraud. At the very least it appears to be some kind of false advertising.

“I Don’t Want to Die”: Needing Mental Health Care, He Got Trapped in His Insurer’s Ghost Network by Max Blau, illustrations by Vanessa Saba, special to ProPublica Sept. 8, 6:05 a.m. EDT Ravi didn’t know it, but he, like millions of Americans, was trapped in a “ghost network.” As some of those people have discovered, the providers listed in an insurer’s network have either retired or died. Many other providers have stopped accepting insurance — often because the companies made it excessively difficult for them to do so. Some just aren’t taking new patients. Insurers are often slow to remove them from directories, if they do so at all. It adds up to a bait and switch by insurance companies that leads customers to believe there are more options for care than actually exist. Ambetter’s parent company, Centene, has been accused numerous times of presiding over ghost networks. One of the 25 largest corporations in America, Centene brings in more revenue than Disney, FedEx or PepsiCo, but it is less known because its hundreds of subsidiaries use different names. In addition to insuring the largest number of marketplace customers, it’s the biggest player in Medicaid managed care and a giant in Medicare Advantage, insurance for seniors that’s offered by private companies instead of the federal government.

My letter to reps:

Health insurance plans, including Medicaid managed care privatized plans and Medicare Advantage plans need to be investigated for fraudulently pretending to have a bigger network of providers than is the reality. Propublica has reported in a Sept. 2024 article about the problem of “ghost networks” being rather widespread. It’s a danger to medical care and public safety. Whatever is leading to this misinformation, we obviously need stronger rules to prevent this kind of misinformation in provider lists. 

Ghost Network 061

Next:Previous: 060

Ghost Network 060

Next: 061

Previous: 059

Ghost Network 059

Next: 060

Previous: 058

Ghost Network 058

Next: 059

Previous: 057

Ghost Network 057

Next: 058

Previous: 056

Ghost Network 056

Next: 057

Previous: 055