Story image

ESET uncovers stealthy Stantinko malware's click fraud prowess

25 Jul 2017

ESET has spotted a malware strain that tricks users into downloading pirated software from dummy torrent sites, and it has so far affected half a million users.

The malware, dubbed Stantinko, has been lurking for the past five years but it has been so adept at changing its form that has been undetected since then.

Researchers say that Stantinko is made up of a bot network. That network is monetised through browser extensions that inject fake ads when browsing the web.

“It allows Stantinko operators to be paid for the traffic they provide to these adverts. We even found users would reach the advertiser’s website directly through Stantinko-owned ads,” comments ESET malware researcher Matthieu Faou.

When Stantinko is installed it can create fake Facebook accounts, like pictures and pages and add friends. It can also conduct Google searches anonymously.

ESET researchers say that Stantinko uses code that looks legitimate, but hidden code is encrypted in Windows Registry or encrypted in a file.

“It is difficult to get rid of once you have it, as each component service has the ability to reinstall the other in case one of them is deleted from the system. To fully eliminate the problem, the user has to delete both services from their machine at the same time,” comments ESET malware researcher Frédéric Vachon.

A key is generated during the initial compromise, which then decrypts the code. Because the command & control server must then launch new components, it’s more difficult to uncover until that happens.

Once launched, the malware then installs ‘The Safe Surfing’ and ‘Teddy Protection’ browser plugins. While they look legitimate, Stantinko configured them to receive rules for click fraud and ad injection, comments ESET senior malware researcher Marc-Etienne Léveillé.

Once the malware is fully operational, attackers can use plugins to control the infected system. The searches can trawl Joomla and WordPress sites with the aim of conducting brute force attacks.

While it has so far been spotted targeting Russia, Ukraine, Belarus and Kazakhstan, the malware’s build is tipped to be a goldmine for click fraud hackers.

The compromised sites can then be sold on the dark web, while its Facebook activities can sell ‘likes’ to unsuspecting users.

While Stantinko could technically be classed as adware, its activities through internet searches, bots and controlling systems also class it as a dangerous backdoor. Researchers point out that it could be used for other malicious purposes.

Story image
04 Dec
Druva extends data protection capabilities for AWS workloads
Capabilities include backup and data management, and long-term archiving for Amazon Elastic Block Store (EBS) snapshots.More
Story image
Today
Successful cloud transformation requires collaboration on network strategy
An organisation’s security team must be invited to the table when a transformation project is in the early planning stages, Zscaler says. More
Link image
White Paper: Choosing the right Business Continuity and Disaster Recovery service provider.
You have designed your Business Continuity Plan and the next step is to choose your service provider. What are the most important things you should consider when choosing one for your business?More
Story image
27 Nov
Interview: Microsoft's Diana Kelley talks talent gaps and D&I
Kelley recently spoke at Microsoft Asia’s new Experience Center, where she talked through her experience as a security CTO, as well as IoT security, what’s ahead in 2020, and diversity and inclusion both in the cybersecurity sector, and in technology.More
Download image
Without automation, you're a sitting duck to cybercriminals. Here's why
Seven cybersecurity experts share their insights, strategies, and best practices surrounding security automation and analytics. More
Story image
28 Nov
IDC names Trend Micro number one vendor for SDC security
The new independent report: Worldwide Software Defined Compute Workload Security Market Shares, 2018 revealed Trend Micro achieved a market share lead of 35.5%, almost triple its nearest competitor in 2018.More