New malware could be selling off your internet bandwidth

New research by Cisco’s Talos intelligence group, has found that threat actors have begun abusing internet-sharing apps, commonly referred to as proxyware

Proxyware platforms are increasingly targeted in cybercrime operations aimed at distributing malware or at monetising the internet bandwidth of victims, according to Cisco’s Talos research and intelligence unit.

The popularity of these platforms has increased rapidly over the past several years, with hundreds of thousands of users already joining them. Legitimate users, however, aren’t the only ones to show increasing interest in proxyware platforms. 

 

What is Proxyware? 


 

Proxyware, also known as internet-sharing applications, are legitimate services that allow users to portion out part of their internet connection for other devices, and may also include firewalls and antivirus programs. 

Other apps will allow users to 'host' a hotspot internet connection, providing them with cash every time a user connects to it. 

It is this format, provided by legitimate services including Honeygain, PacketStream, and Nanowire, which is being used to generate passive income on behalf of cyberattackers and malware developers. 

 

How are malicious actors using these platforms? 

 

According to the researchers, proxyware is being abused in the same way as legitimate cryptocurrency mining software: quietly installed, either as a side component or as a main payload, and with efforts taken to try and stop a victim from noticing its presence, such as through resource use control and obfuscation. 

In cases documented by Cisco Talos, proxyware is included in multi-stage attacks. An attack chain begins with a legitimate software program bundled together with a Trojanised installer containing malicious code. When the software is installed, the malware is also executed. One campaign has utilised a legitimate, signed Honeygain package which was patched to also drop separate, malicious files containing an XMRig cryptocurrency miner and to redirect the victim to a landing page connected to Honeygain referral codes. 

Once the victim signs up for an account, this referral earns revenue for an attacker, all the while a cryptocurrency miner is also stealing computer resources. 

This isn't the only method used to generate cash, in a separate campaign, a malware family was identified that tries to install Honeygain on a victim's PC and registers the software under an attacker's account, and so any earnings are sent to the fraudster. 

"While Honeygain limits the number of devices operating under a single account, there is nothing to stop an attacker from registering multiple Honeygain accounts to scale their operation based on the number of infected systems under their control," the researchers say. 

 

 

Share

Featured Articles

TECH LIVE LONDON: An overview of the hybrid technology show

We take a look at the first day of Tech Live London with insights from technology leaders from companies such as IBM, Microsoft and Vodafone

TECH LIVE LONDON: Begins tomorrow at 10am!

Our marquee technology event is nearly here. There's still time to claim your free ticket (worth £295). Look forward to welcoming you to the Tobacco Dock!

Executive Q&A: Marc Lueck, CISO EMEA, Zscaler

As we prepare to welcome the Zero Trust leaders to TECH LIVE LONDON this June 23-24, we take the opportunity to chat to Zscaler CISO of EMEA, Marc Lueck

TECH LIVE LONDON: Registering, networking and logistics

Digital Transformation

New speaker from Infosys announced for TECH LIVE LONDON!

Digital Transformation

New speaker from Bernadette announced for TECH LIVE LONDON!

Digital Transformation