Sophos Uncovers a New Malware that Prevents Users from Browsing Pirated Websites
Sophos, a global leader in next-generation cybersecurity, today published new research, “Vigilante Malware Rats Out Software Pirates While Blocking ThePirateBay,” which details a curious cyberattack campaign that targets users of pirated software with malware designed to block access to websites hosting pirated software.
The developers disguise the malware as cracked versions of popular online games such as Minecraft and Among Us, as well as productivity tool such as Microsoft Office, security software and others. The disguised malware is distributed via the BitTorrent platform from an account hosted on “ThePirateBay” digital filesharing website. Links to the malware are also hosted on Discord. Once installed, the malware blocks the victim’s access to a long list of websites, including many that distribute pirated software.
Unusual aspects of the operation uncovered by Sophos researchers include:
* The attackers use an age-old approach of modifying the HOSTS file settings on an infected device to “localhost” a long list of websites, thereby blocking the user’s access to them. This approach is fairly easy to reverse and Sophos researchers are unsure why the attackers used it
* Some of the many hundreds of sites that are being “localhosted” by the malware are unrelated to pirated software and some were shut down or became inactive in or around 2012/2013
* The malicious files are compiled for 64-bit Windows 10 and then signed with bogus digital certificates that wouldn’t pass more than a very rudimentary check
* Once downloaded and installed by a user, the malware hunts for files named 7686789678967896789678 and 412412512512512. If it finds them it stops any further launch of the attack. Sophos researchers believe this could be designed to prevent the malware operators from infecting their own computers while they work on the malicious code
* The malware also triggers a fake error message to appear when it runs, which asks people to re-install the software. Sophos researchers believe this could be to allay suspicion among users who wonder why the program they received didn’t contain the installers they were expecting
Andrew Brandt, principal threat researcher, Sophos, said: “Sometimes it is easy to see clearly what an adversary’s end game is and why they have chosen a particular approach to achieve it. This is not one of those times.
“On the face of it, the adversary’s targets and tools suggest this could be some kind of crudely-compiled anti-piracy vigilante operation. However, the attacker’s vast potential target audience – from gamers to business professionals – combined with the curious mix of dated and new tools, techniques and procedures (TTPs) and the bizarre list of websites blocked by the malware, all make the ultimate purpose of this operation a bit murky. There may not even be an overall purpose to this attack at all. However, that doesn’t reduce the level of risk or the potential disruption for victims. To stay safe from such attacks, install a robust security solution that will spot such scams before they reach you, and avoid downloading pirated software or anything offering you suspiciously too-good-to-be true ‘legitimate’ software.”
Akamai reports Edge-Based Innovation to take Center Stage in Asia
According to Akamai, in a world transformed by COVID-19, edge computing will constitute on...
MongoDB brings pay-as-you-go offering in AWS Marketplace
MongoDB, Inc. announced that it will make it easier for customers to build, scale, and man...
Accenture Announces Extended Relationship with AWS and Joint Investments to Help Organizations Get to Cloud Value Faster
Accenture (NYSE: ACN) today announced the renewal of its joint business group with Amazon...
Tech Data along with IBM bringing value to the channel eco-system
Recently VARINDIA has organized an event with Tech data and IBM focussing on ‘Bid sm...
OPPO to Host OPPO INNO DAY 2021, first ever virtual INNO WORLD
OPPO announced it will host the annual OPPO INNO DAY on 14-15 December 2021 in Shenzhen, C...
Crestron Electronics organises "CresEmpower" in Ahmedabad for its consultants
Crestron Electronics organised a Training and Demo Session for its esteemed consultants of...