A "large and resilient infrastructure" comprising over 250 domains is being used to distribute information-stealing malware such as
Raccoon and
Vidar since early 2020.
The infection chain "uses about a hundred of fake cracked software catalogue websites that redirect to several links before downloading the payload hosted on file share platforms, such as GitHub," cybersecurity firm SEKOIA
said in an analysis published earlier this month.
The French cybersecurity company assessed the domains to be operated by a threat actor running a traffic direction system (
TDS), which allows other cybercriminals to rent the service to distribute their malware.
The attacks target users searching for cracked versions of software and games on search engines like Google, surfacing fraudulent websites on top by leveraging a technique called search engine optimization (SEO) poisoning to lure victims into downloading and executing the malicious payloads.
The poisoned result comes with a download link to the promised software that, upon clicking, triggers a five-stage URL redirection sequence to take the user to a web page displaying a shortened link, which points to a password-protected RAR archive file hosted on GitHub, along with its password.
"Using several redirections complicates automated analysis by security solutions," the researchers said. "Carving the infrastructure as such is almost certainly designed to ensure resilience, making it easier and quicker to update or change a step."
thehackernews.com
