Cybercrime is available in many various flavors, most of it being financially-oriented. Phishers, scammers and malware operators are probably the most seen ones, but there are another profiles within the cybercrime economic system who play an essential function and are but very discreet: Traffers.
A brand new.
What’s a traffer?
Traffers — from the Russian phrase “Траффер,” additionally known as “employee” — are cybercriminals answerable for redirecting Web customers community visitors to malicious content material that they function, this content material being malware more often than not.
Traffers are typically organized as groups and compromise web sites in an effort to hook the visitors and convey the guests to malicious content material. They may additionally construct web sites serving the identical goal. As uncovered by Sekoia researchers who’ve monitored Russian talking cybercrime boards, the traffer ecosystem is constructed of each extremely expert profiles and new ones, making it an excellent entry level for rookies in cybercrime.
The “lolz Guru” underground discussion board particularly exhibits fixed new creation of traffers groups, each month of 2022 seeing between 5 and 22 new traffers groups (Determine A).
As soon as created, a traffer workforce may evolve and reorganize, merge with different groups or restart from scratch, which makes it troublesome to judge the longevity of traffer groups. One administrator of such a workforce has indicated it value him $3,000 to create a traffer workforce of 600 folks earlier than promoting it. A traffer workforce dubbed “Moon Group” was priced at $2,300 in Might 2022.
The everyday group for such a workforce is fairly simple: One or a number of workforce directors lead traffers but additionally deal with the malware licenses and the evaluation and promoting of the logs collected by the traffers (Determine B).
What are traffer workforce strategies?
The most important exercise from traffers consists of redirecting Web customers to malware, 90% of which consists of knowledge stealers. The data stolen by the malware will be legitimate credentials for on-line providers, mailboxes, cryptocurrencies wallets or bank card info. All of these are referred to as logs.
The workforce directors do promote these logs to different cybercriminals who exploit this information for monetary achieve.
The directors are additionally answerable for dealing with the malware they want, shopping for licenses to the malware builders and spreading it to the workforce.
The directors additionally present their groups members with a equipment containing totally different sources:
- Continuously up to date malware information (additionally referred to as “malware builds”) prepared to be used.
- A crypter service or software, essential to encrypt or obfuscate the malware information.
- A handbook and pointers for traffers.
- A SEO service to enhance the visibility and variety of connections to their infrastructure.
- A Telegram channel to speak simply between workforce members.
- Telegram bots for automating duties, resembling sharing new malware information and creating statistics.
- A devoted log evaluation service to make sure the logs offered by the directors are legitimate.
As soon as recruited, traffers are capable of get the malware information and distribute through redirections from compromised web sites. They’re paid based mostly on the standard and amount of knowledge they gather from the malware they deploy.
Traffers are sometimes challenged into competitions organized by the directors. The winners get additional money and entry knowledgeable model of the membership. This entry permits them to make use of a second malware household, get higher providers and bonuses.
Every traffer makes use of their very own supply chain so long as it complies with the workforce necessities.
In keeping with Sekoia, widespread supply strategies embrace web sites masquerading as blogs or software program set up pages and delivering password protected archive information in an effort to keep away from detection. Skilled traffers appear to have an excellent data of promoting platforms and handle to extend the promotion of their web sites through these providers. The draw back of this type of supply methodology for the attackers is that it typically hits many victims and is due to this fact extra rapidly detected than different supply methodology.
The 911 an infection chain
The vast majority of traffers groups monitored by Sekoia are literally exploiting a technique referred to as “911” in underground boards.
It consists of utilizing stolen YouTube accounts to distribute hyperlinks to malware managed by the traffers. The traffer makes use of the account to add a video engaging the customer to obtain a file, disable Home windows Defender and execute it. Usually, the video is about cracking software program. The video explains tips on how to proceed and supplies hyperlinks to instruments for putting in cracked software program, generate a license key or cheat at totally different video video games. As soon as executed, these information infect the pc with malware.
The malware is mostly saved on professional file serving providers resembling Mega, Mediafire, OneDrive, Discord or GitHub. Usually it’s a password protected archive file, which comprises the stealer malware (Determine C).
What malware is utilized by traffers?
Essentially the most used info stealing malware utilized by traffers, as noticed by Sekoia, are Redline, Meta, Raccoon, Vidar and Personal Stealer.
The Redline malware is taken into account the best stealer, because it is ready to entry credentials from net browsers, cryptocurrency wallets, native system information and several other functions.
Redline additionally permits the directors to simply monitor traffer exercise by associating a singular botnet title within the samples distributed by a traffer. Stolen information coming from using Redline are offered on a number of marketplaces. Meta is a brand new malware and is marketed as an up to date model of Redline, changing into the malware of alternative for some traffer groups.
How you can shield your self from traffers
This risk is very associated to malware and will goal people as a lot as corporations. Deploy safety options and antivirus options on all endpoints and servers of the corporate. Working techniques and all software program also needs to be saved updated and patched to stop them from being contaminated by the exploitation of a typical vulnerability.
Customers ought to be skilled to detect phishing threats and to keep away from at any case utilizing cracked software program or instruments. Multi-factor authentication ought to be used each time doable. A traffer checking for the validity of stolen credentials may simply drop it whether it is unusable with out a second authentication channel.
Disclosure: I work for Development Micro, however the views expressed on this article are mine.