Malware-as-a-Service (MaaS) : The 9-to-5 of Organized Cybercrime

guest · Oct 31, 2020

Anyone, even you, can carry out cyberattacks with the Malware-as-a-Service model
October 30, 2020
https://www.seqrite.com/blog/anyone...rattacks-with-the-malware-as-a-service-model/

In an age where solutions like cloud, mobility, storage and security are offered as part of service models, it is to no surprise that malware also has its service offering, aptly called Malware-as-a-Service (MaaS)?

Of course, there’s a misnomer in the name itself — unlike the other solutions, malware isn’t really of any kind of service to the end-user. It’s the opposite — malware is likely to cause serious damage and information loss to enterprise systems.
Malware on sale to the highest bidder
The Malware-as-a-Service model is a result of the current evolution of solutions & services being offered through external parties.

We have previously written about “script kiddies” who buy packaged malware exploits from black markets or the dark web and run their payloads to make profits. This is the Malware-as-a-Service model in a nutshell where ‘Darknet’ markets offer different varieties of malware exploits for sale to interested bidders.
Click to expand...

There are three key levels in the MaaS model. Let’s understand each of them:
First level: Developers of Malware
These are the elite-level experts who are masters of cybercrime. They keep experimenting and creating highly developed malware using different techniques with an added emphasis on zero-day exploits.
Second level: Sellers & Distributers of Malware
The individuals involved at this level are concerned with the selling and distribution of the malware created by expert developers.
Third level: Buyers of Malware
Everyone who wants to buy malware can be classified into this level. They may involve cybercriminals without the necessary technical knowledge to carry out exploits on their own, security agencies from nation-states aiming to buy malware to study it or to use it against enemy states or even cybersecurity researchers.
Click to expand...

The Malware-as-a-Service model is dangerous for enterprises as it reduces the amount of effort and knowledge for threat actors to carry out cyberattacks.
Click to expand...

guest · Jun 25, 2021

Malware-as-a-Service is a Booming Business
June 25, 2021
https://www.infosecurity-magazine.com/opinions/malware-service-booming-business/

Malware-as-a-service (MaaS) has grown into a booming business for cybercrime organizations. The ransomware plague is estimated to have cost the world over $1bn in 2020, with attackers using MaaS to target large enterprises with critical or sensitive assets – which is known in the industry as “big game hunting.”

MaaS has become popular because it is powerful and instantly ready to use. Malware creators handle the development and maintenance of MaaS, emboldening less sophisticated threat actors by removing the need for exploit-writing technical skills.
Similar to the software as a services (SaaS) revenue model, MaaS offers access to botnets that distribute malware. The paid service usually includes a personal account where non-technical cyber-criminals can control the attack and get technical support.
Click to expand...

guest · Dec 3, 2022

New DuckLogs malware service claims having thousands of ‘customers’
By Bill Toulas @billtoulas - December 1, 2022

A new malware-as-a-service (MaaS) operation named 'DuckLogs' has emerged, giving low-skilled attackers easy access to multiple modules to steal information, log key strokes, access clipboard data, and remote access to the compromised host.
Click to expand...

DuckLogs is entirely web-based. It claims to have thousands of cybercriminals paying a subscription to generate and launch more than 4,000 malware builds.
The operators appear to provide additional services to some customers, helping them to distribute the payload, a tool to drop files, and an extension changer.

The web panel shows that more than 2,000 cyberscriminals are using the malicious platform and the current victim count is above 6,000.
Click to expand...

DuckLogs features
DuckLogs includes mainly an information stealer and a remote access trojan (RAT) component but it has more than 100 individual modules that target specific applications.

Below is a list of some of the data and applications the info-stealing component targets: [...]
Click to expand...

The web-based panel is currently available on four clearnet domains and appears to provide powerful payload-building features with options for the modules and functions to be added to the final malware build.

Additionally, the builder provides some anti-evasion choices, like adding an exclusion for Windows Defender, payload execution delay, or disabling the Task Manager on the host.
Click to expand...

Cyble: Malware-As-A-Service Provides Sophisticated Features To Threat Actors

December 1, 2022
Cyble Research and Intelligence Labs (CRIL) has been continuously monitoring malware families that are new and active in the wild. Recently, CRIL observed a new malware strain named DuckLogs, which performs multiple malicious activities such as Stealer, Keylogger, Clipper, Remote access, etc. The CRIL also observed multiple active instances of DuckLogs C&C servers in the wild, indicating that the malware is emerging now.

DuckLogs is MaaS (Malware-as-a-Service). It steals users’ sensitive information, such as passwords, cookies, login data, histories, crypto wallet details, etc., and exfiltrates the stolen data from the victim’s machine to its C&C server. The below figure shows the Threat Actors (TAs) advertisement in the cybercrime forum about DuckLogs.
Click to expand...

guest · Jan 27, 2023

Experts Uncover the Identity of Mastermind Behind Golden Chickens Malware Service
By Ravie Lakshmanan - January 27, 2023

Cybersecurity researchers have discovered the real-world identity of the threat actor behind Golden Chickens malware-as-a-service, who goes by the online persona "badbullzvenom."
Click to expand...

eSentire's Threat Response Unit (TRU), in an exhaustive report published following a 16-month-long investigation, said it "found multiple mentions of the badbullzvenom account being shared between two people."

The second threat actor, known as Frapstar, is said to identify themselves as "Chuck from Montreal," enabling the cybersecurity firm to piece together the criminal actor's digital footprint.
Click to expand...

Golden Chickens, also known as Venom Spider, is a malware-as-a-service (MaaS) provider that's linked to a variety of tools such as Taurus Builder, software to create malicious documents; and More_eggs, a JavaScript downloader that's used to serve additional payloads.

The threat actor's cyber arsenal has been put to use by other prominent cybercriminal groups like Cobalt Group (aka Cobalt Gang), Evilnum, and FIN6, all of which are estimated to have collectively caused losses totaling $1.5 billion.
Click to expand...

It's suspected that Chuck is one of the two threat actors operating the badbullzvenom account on the Exploit.in underground forum, with the other party possibly located in Moldova or Romania, eSentire noted.

"The malware suite is still actively being developed and is being and sold to other threat actors," the researchers concluded, urging organizations to be on the lookout for potential phishing attempts.
Click to expand...

eSentire: Unmasking VENOM SPIDER

by Joe Stewart and Keegan Keplinger
Key Findings
Who is badbullzvenom? Reading through the history of the threat actor’s posts on the Russian-language hacker forum, Exploit.in, TRU found multiple mentions of the badbullzvenom account being shared between two people. From the posts, we learn the following about badbullzvenom:

They claim to be from Moldova

They speak Romanian, French, and English

They claim to work with Russia-based Cobalt Gang (this is also evident in public analysis of Golden Chickens campaign IOCs)

Click to expand...

Log in or Sign up

Malware-as-a-Service (MaaS) : The 9-to-5 of Organized Cybercrime

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Malware-as-a-Service (MaaS) : The 9-to-5 of Organized Cybercrime

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches