Hackers are targeting other hackers by infecting their tools with malware

guest · Mar 10, 2020

Hackers are targeting other hackers by infecting their tools with malware
March 10, 2020
https://techcrunch.com/2020/03/09/hacking-the-hackers/

A newly discovered malware campaign suggests that hackers have themselves become the targets of other hackers, who are infecting and repackaging popular hacking tools with malware.

Cybereason’s Amit Serper found that the attackers in this years-long campaign are taking existing hacking tools — some of which are designed to exfiltrate data from a database through to cracks and product key generators that unlock full versions of trial software — and injecting a powerful remote-access trojan. When the tools are opened, the hackers gain full access to the target’s computer.

Serper said the attackers are “baiting” other hackers by posting the repackaged tools on hacking forums.
But it’s not just a case of hackers targeting other hackers, Serper told TechCrunch. These maliciously repackaged tools are not only opening a backdoor to the hacker’s systems, but also any system that the hacker has already breached.
Click to expand...

Serper found that these as-yet-unknown attackers are injecting and repackaging the hacking tools with njRat, a powerful trojan, which gives the attacker full access to the target’s desktop, including files, passwords, and even access to their webcam and microphone.

It’s unclear for what reason this campaign exists or who is behind it.
Click to expand...

Cybereason: Who's Hacking the Hackers: No Honor Among Thieves

guest · Sep 3, 2022

Prynt Stealer Contains a Backdoor to Steal Victims' Data Stolen by Other Cybercriminals
By Ravie Lakshmanan - September 2, 2022

Researchers discovered a private Telegram channel-based backdoor in the information stealing malware, dubbed Prynt Stealer, which its developer added with the intention of secretly stealing a copy of victims' exfiltrated data when used by other cybercriminals.

"While this untrustworthy behavior is nothing new in the world of cybercrime, the victims' data end up in the hands of multiple threat actors, increasing the risks of one or more large scale attacks to follow," Zscaler ThreatLabz researchers Atinderpal Singh and Brett Stone-Gross said in a new report.
Prynt Stealer, which came to light earlier this April, comes with capabilities to log keystrokes, steal credentials from web browsers, and siphon data from Discord and Telegram. It's sold for $100 for a one-month license and $900 for a lifetime subscription.
Click to expand...

The cybersecurity firm analysis of Prynt Stealer shows that its codebase is derived from two other open source malware families, AsyncRAT and StormKitty, with new additions incorporated to include a backdoor Telegram channel to collect the information stolen by other actors to the malware's author.

The code responsible for Telegram data exfiltration is said to be copied from StormKitty, but for a few minor changes.
Click to expand...

While bad actors have employed similar data stealing tactics in the past where the malware is given away for free, the development marks one of the rare instances where a stealer that's sold on a subscription basis is also sending the plundered information back to its developer.

"Note that there are cracked/leaked copies of Prynt Stealer with the same backdoor, which in turn will benefit the malware author even without direct compensation," the researchers said.

Zscaler said it identified two more variants of Prynt Stealer variants dubbed WorldWind and DarkEye written by the same author, the latter of which is bundled as an implant with a "free" Prynt Stealer builder.
Click to expand...

Zscaler: No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed

By Atinderpal Singh and Brett Stone-Gross - September 1, 2022
Technical Comparison of Prynt Stealer, WorldWind, and DarkEye Malware
Key Points
• Prynt Stealer is an information stealer that has the ability to capture credentials that are stored on a compromised system including web browsers, VPN/FTP clients, as well as messaging and gaming applications
• The Prynt Stealer developer based the malware code on open source projects including AsyncRAT and StormKitty
• Prynt Stealer uses Telegram to exfiltrate data that is stolen from victims
• The Prynt Stealer malware author added a backdoor Telegram channel to collect the information stolen by other criminals
• The informational stealer malware families known as DarkEye and WorldWind are near identical to Prynt Stealer
Click to expand...

Log in or Sign up

Hackers are targeting other hackers by infecting their tools with malware

guest Guest

guest Guest

Log in or Sign up

Hackers are targeting other hackers by infecting their tools with malware

guest Guest

guest Guest

Useful Searches