Story image

ESET uncovers stealthy Stantinko malware's click fraud prowess

25 Jul 17

ESET has spotted a malware strain that tricks users into downloading pirated software from dummy torrent sites, and it has so far affected half a million users.

The malware, dubbed Stantinko, has been lurking for the past five years but it has been so adept at changing its form that has been undetected since then.

Researchers say that Stantinko is made up of a bot network. That network is monetised through browser extensions that inject fake ads when browsing the web.

“It allows Stantinko operators to be paid for the traffic they provide to these adverts. We even found users would reach the advertiser’s website directly through Stantinko-owned ads,” comments ESET malware researcher Matthieu Faou.

When Stantinko is installed it can create fake Facebook accounts, like pictures and pages and add friends. It can also conduct Google searches anonymously.

ESET researchers say that Stantinko uses code that looks legitimate, but hidden code is encrypted in Windows Registry or encrypted in a file.

“It is difficult to get rid of once you have it, as each component service has the ability to reinstall the other in case one of them is deleted from the system. To fully eliminate the problem, the user has to delete both services from their machine at the same time,” comments ESET malware researcher Frédéric Vachon.

A key is generated during the initial compromise, which then decrypts the code. Because the command & control server must then launch new components, it’s more difficult to uncover until that happens.

Once launched, the malware then installs ‘The Safe Surfing’ and ‘Teddy Protection’ browser plugins. While they look legitimate, Stantinko configured them to receive rules for click fraud and ad injection, comments ESET senior malware researcher Marc-Etienne Léveillé.

Once the malware is fully operational, attackers can use plugins to control the infected system. The searches can trawl Joomla and WordPress sites with the aim of conducting brute force attacks.

While it has so far been spotted targeting Russia, Ukraine, Belarus and Kazakhstan, the malware’s build is tipped to be a goldmine for click fraud hackers.

The compromised sites can then be sold on the dark web, while its Facebook activities can sell ‘likes’ to unsuspecting users.

While Stantinko could technically be classed as adware, its activities through internet searches, bots and controlling systems also class it as a dangerous backdoor. Researchers point out that it could be used for other malicious purposes.

What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Bitdefender announces security integration with Kaseya
The new partnership will allow VSA by Kaseya’s cloud and on-premises users to deploy and manage security with Bitdefender Cloud Security for MSPs.
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.