Glupteba Trojan Makes a Comeback Taking Aim at Large Enterprises

guest · Dec 18, 2019

Glupteba Trojan Makes a Comeback Taking Aim at Large Enterprises
December 16, 2019
https://businessinsights.bitdefende...es-a-comeback-taking-aim-at-large-enterprises

For an attacker, using a known piece of malware carries both advantages and disadvantages. While security researchers know exactly what infection patterns to look for, old malware can still go unnoticed if it’s not trending or if it uses new tricks to avoid detection. Glupteba does both.

Glupteba is a backdoor first spotted in 2014, so it’s by no means a new development. However, at the end of 2018, Bitdefender’s Advanced Threat Control (ATC) team observed a surge in detections [...] They found a substantial increase in targeted attacks in business environments using the infamous Trojan, suggesting an extensive campaign with a renewed focus on enterprise customers.

Bitdefender has published a technical paper – Old dog with new tricks. A study on the resurfacing of the Glupteba malware – revealing the nuts and bolts of Glupteba and describing how our technologies catch the malware before it can wreak havoc.
Click to expand...

Revisiting Glupteba: Still Relevant Five Years after Debut

Whitepaper: "Old dog with new tricks. A study on the resurfacing of the Glupteba malware"
(PDF - 3.45 MB): https://www.bitdefender.com/files/News/CaseStudies/study/301/Bitdefender-Glupteba-Old-Dog-New-Tricks-en-EN.pdf

guest · Jun 24, 2020

This sneaky malware goes to unusual lengths to cover its tracks
June 24, 2020
https://www.zdnet.com/article/this-sneaky-malware-goes-to-unusual-lengths-to-cover-its-tracks/

A malware campaign which creates a backdoor providing full access to compromised Windows PC, while adding them to a growing botnet, has developed some unusual measures for staying undetected.

Glupteba first emerged in 2018 and started by gradually dropping more components into place on infected machines in its bid to create a backdoor to the system.
The malware is continuously in development and in the last few months it appears to have been upgraded with new techniques and tactics to coincide with a new campaign which has been detailed by cybersecurity researchers at Sophos.

The paper describes Glupteba as "highly self-defending malware" with the cyber criminal group behind it paying special attention to "enhancing features that enable the malware to evade detection".
Click to expand...

Sophos said the rootkit renders filesystem behavior invisible to the computer's end user, and also protects any other file the malware decides to store in its application directory. A watcher process then monitors the rootkit and other components for any sign of failure or a crash, and can reinitialize the rootkit driver or restart a buggy component.

"They've also contrived a somewhat convoluted method to conceal their updates to command-and-control server addresses in plain sight, by staging those updates as encrypted data tied to transactions in the bitcoin blockchain," Brandt added.
Click to expand...

Sophos: Glupteba malware hides in plain sight

A worm focused on concealment and stealth may keep malware payloads hidden from view
Click to expand...

JRViejo · Jun 28, 2022

On December 7, 2021, Google announced it was suing two Russian men allegedly responsible for operating the Glupteba botnet, a global malware menace that has infected millions of computers over the past decade. That same day, AWM Proxy — a 14-year-old anonymity service that rents hacked PCs to cybercriminals — suddenly went offline. Security experts had long seen a link between Glupteba and AWM Proxy, but new research shows AWM Proxy’s founder is one of the men being sued by Google.
Click to expand...

The Link Between AWM Proxy & the Glupteba Botnet - KrebsOnSecurity

guest · Nov 18, 2022

Google Wins Lawsuit Against Glupteba Botnet Operators
By Eduard Kovacs @EduardKovacs - November 17, 2022

Google has won a lawsuit against operators of a botnet named Glupteba, which the internet giant disrupted last year.
Click to expand...

Google announced in December 2021 that it had taken action to disrupt the botnet’s C&C infrastructure. The company said at the time that even if its actions may not completely stop the botnet, they should still affect its operators’ ability to conduct future operations. It’s unclear if the botnet is currently active.

Glupteba had been powered by one million compromised Windows devices. The Glupteba malware could steal user credentials and other data, mine cryptocurrencies, and turn compromised devices into proxies.
Click to expand...

The lawsuit named Russian nationals Dmitry Starovikov and Alexander Filippov, who allegedly helped lead the criminal enterprise, as well as 15 Does who had some role in operating the Glupteba botnet.

A Southern District of New York court this week granted Google default judgment and issued monetary sanctions against the defendants and their US-based council. They were ordered to pay Google’s attorney fees, which is a rare occurrence.
Click to expand...

Judge Denise Cote said they did not intend to defend themselves against Google in court and instead they were planning on abusing the court system and discovery rules to obtain information that would help them bypass Google’s efforts to shut down the botnet.
Click to expand...

guest · Dec 29, 2022

Glupteba Malware Is Back Again: Here’s What You Need to Know
By Gabriella Antal - December 19, 2022

Glupteba is a backdoor trojan that can be downloaded via computer networks to infiltrate your device on the Internet and steal confidential information.
Nearly a year after Glupteba malware was disrupted, the botnet has resurfaced and is now spreading across devices.
Click to expand...

Glupteba, an Old Enemy Returns
Nozomi reports that Glupteba continues to use the blockchain, in the same way today, so its analysts scanned the entire blockchain to unearth hidden C2 domains.

The effort to create a decryption tool for the malware that caused this crypto exchange hack was immense. It involved scouring 1,500 Glupteba sample files uploaded to VirusTotal and decrypting transaction payload data using keys it struck against the malware’s program code.
Click to expand...

The Nozomi investigation identified 15 Bitcoin addresses used in four Glupteba campaigns. One of these campaigns started six months after Google’s disruption and is still ongoing.
Botnets use more addresses than past operations. They’re resilient because they have more Bitcoin addresses.

The number of TOR hidden services used as C2 servers has increased tenfold since the 2021 campaign. After being identified, these servers were preemptively destroyed to minimize their risk.
Click to expand...

Log in or Sign up

Glupteba Trojan Makes a Comeback Taking Aim at Large Enterprises

guest Guest

guest Guest

JRViejo Super Moderator

guest Guest

guest Guest

Log in or Sign up

Glupteba Trojan Makes a Comeback Taking Aim at Large Enterprises

guest Guest

guest Guest

JRViejo Super Moderator

guest Guest

guest Guest

Useful Searches