Attackers Profiting from Proxyware

guest · Jul 28, 2022

MS-SQL servers hacked to steal bandwidth with proxyware
July 28, 2022

Threat actors have been adopting a less common method to generate revenue and are leveraging payloads to install proxyware services on target systems.

Proxyware is a program that allows allocating available internet bandwidth over a proxy to users that need it for various tasks, like testing, intelligence collection, content distribution, or market research. In return, bandwidth donors get cash.
Click to expand...

According to a new report published today by researchers at South Korean company Ahnlab, new malware campaigns have emerged that install proxyware to earn money from sharing their victim's network bandwidth.

The attackers receive compensation for the bandwidth by setting their email address for the user, while the victims might only notice some connectivity slowdowns and hiccups.
Smuggling the clients
Ahnlab observed the smuggling of installers for the services Peer2Profit and IPRoyal, while the initial infection occurs via adware like Noereklami or other malware strains.
Click to expand...

Infecting MS-SQL servers too
According to Ahnlab’s report, the malware operators that make a profit using this less typical method are also targeting vulnerable MS-SQL servers to installPeer2Profit clients.

This has been going on since early June 2022, with most logs retrieved from infected systems revealing the existence of a UPX-packed database file named “sdk.mdf”.
Click to expand...

The reason behind using proxyware clients is likely an increased chance to remain undetected for longer periods, which translates into larger profits. It is unclear how much money actors generate via this method, though.
Click to expand...

Ahnlab: Attackers Profiting from Proxyware

Proxyware is a program that shares a part of the Internet bandwidth that is currently available on a system to others. Users who install the program are usually paid with a certain amount of cash in exchange for providing the bandwidth. Companies that provide such a service include Peer2Profit and IPRoyal. They gain profit by providing the bandwidth to other companies and claim on their webpages that they have various business partners using the service for distributing software, investigating markets, verifying advertisements, testing software, and so on.

While users can earn some money from installing proxyware on their systems, they should know they are taking risks by allowing external users to perform certain behaviors by using their networks. For instance, users cannot know in detail the companies that the proxyware platforms claim to use their services. Even if they can verify their customers on their own, it is impossible to check if your bandwidth will be maliciously exploited in the future or not.
Click to expand...

guest · Aug 5, 2022

A new type of cryptomining attack aims to hijack network bandwidth
August 3, 2022

Researchers on Tuesday found a new type of cryptomining attack in the wild that’s designed to hijack network bandwidth.

In a blog post, Aqua Nautilus researchers said up to now, cryptominers sought to conduct extensive, complicated calculations to generate cryptocurrency. By doing so, they exploited the CPUs of their targets.
In addition, the network bandwidth consumption is high. So this technique lets new cryptominers stay under the radar with some security tools because they are sensitive only to high CPU usage and may miss this new cryptojacking tactic.
Click to expand...

Aqua’s researchers said they detected the new type of cryptojacking malware targeting its honeypots this past February. The attack came from an account called peer2profit, a name that drew their attention, but the container was tagged by Aqua’s detectors as a cryptominer since it showed a similar behavior.

They then conducted further research focusing on peer2profit and found it was targeting PKT Cash, a site that lets users profit from excess bandwidth.
Click to expand...

This kind of attack represents a natural evolution of what we’ve seen for years, said John Steven, CTO at ThreatModeler.
Click to expand...

Aqua Security: Threat Alert: Cloud Network Bandwidth Now Stolen through Cryptojacking

PKT Cash - A Crypto Coin
PKT cash is a decentralized blockchain that allows individuals to earn money by sharing their internet bandwidth.
This crypto endeavor allows individuals to download a piece of software called packetcrypt which permits them to share their bandwidth with the PKT network.

Peer2profit is an application based on the PKT cash technology aimed at attracting the attention of a less tech savvy audience. It contains fewer details about the technology and more about business opportunities. It is often presented in a website and offers the ability to download software that runs on various systems.
Click to expand...

Log in or Sign up

Attackers Profiting from Proxyware

guest Guest

guest Guest

Log in or Sign up

Attackers Profiting from Proxyware

guest Guest

guest Guest

Useful Searches