Story image

ESET uncovers stealthy Stantinko malware's click fraud prowess

25 Jul 2017

ESET has spotted a malware strain that tricks users into downloading pirated software from dummy torrent sites, and it has so far affected half a million users.

The malware, dubbed Stantinko, has been lurking for the past five years but it has been so adept at changing its form that has been undetected since then.

Researchers say that Stantinko is made up of a bot network. That network is monetised through browser extensions that inject fake ads when browsing the web.

“It allows Stantinko operators to be paid for the traffic they provide to these adverts. We even found users would reach the advertiser’s website directly through Stantinko-owned ads,” comments ESET malware researcher Matthieu Faou.

When Stantinko is installed it can create fake Facebook accounts, like pictures and pages and add friends. It can also conduct Google searches anonymously.

ESET researchers say that Stantinko uses code that looks legitimate, but hidden code is encrypted in Windows Registry or encrypted in a file.

“It is difficult to get rid of once you have it, as each component service has the ability to reinstall the other in case one of them is deleted from the system. To fully eliminate the problem, the user has to delete both services from their machine at the same time,” comments ESET malware researcher Frédéric Vachon.

A key is generated during the initial compromise, which then decrypts the code. Because the command & control server must then launch new components, it’s more difficult to uncover until that happens.

Once launched, the malware then installs ‘The Safe Surfing’ and ‘Teddy Protection’ browser plugins. While they look legitimate, Stantinko configured them to receive rules for click fraud and ad injection, comments ESET senior malware researcher Marc-Etienne Léveillé.

Once the malware is fully operational, attackers can use plugins to control the infected system. The searches can trawl Joomla and WordPress sites with the aim of conducting brute force attacks.

While it has so far been spotted targeting Russia, Ukraine, Belarus and Kazakhstan, the malware’s build is tipped to be a goldmine for click fraud hackers.

The compromised sites can then be sold on the dark web, while its Facebook activities can sell ‘likes’ to unsuspecting users.

While Stantinko could technically be classed as adware, its activities through internet searches, bots and controlling systems also class it as a dangerous backdoor. Researchers point out that it could be used for other malicious purposes.

Aerohive launches guide to cloud-managed network access control
NAC for Dummies teaches the key aspects of network access control within enterprise IT networks and how you can secure all devices on the network.
Sungard AS named DRaaS leader by Forrester
It was noted for its disaster-recovery-as-a-service solution’s ability to “serve client needs at all stages of their need for business continuity.”
Gartner: The five priorities of privacy executives
The priorities highlight the need for strategic approaches to engage with shifting regulatory, technology, customer and third-party risk trends.
emt Distribution adds risk intelligence vendor
Flashpoint has signed emt Distribution to provide channel partners in Oceania and South East Asia a solution for illicit threat actor communities.
CrowdStrike: Improving network security with cloud computing solutions
Australian spending on public cloud services is expected to reach $6.5 billion this year according to Gartner
Thycotic debunks top Privileged Access Management myths
Privileged Access encompasses access to computers, networks and network devices, software applications, digital documents and other digital assets.
Veeam reports double-digit Q1 growth
We are now focussed on an aggressive strategy to help businesses transition to cloud with Backup and Cloud Data Management solutions.
Paving the road to self-sovereign identity using blockchain
Internet users are often required to input personal information and highly-valuable data from contact numbers to email addresses to make use of the various platforms and services available online.