Meet Prometheus, the secret TDS behind some of today’s malware campaigns

guest · Aug 5, 2021

Meet Prometheus, the secret TDS behind some of today’s malware campaigns
August 5, 2021
https://therecord.media/meet-prometheus-the-secret-tds-behind-some-of-todays-malware-campaigns/

A recently discovered cybercrime service is helping malware gangs distribute their malicious payloads to unsuspecting users using hacked websites.

Named Prometheus, the service is what security researchers call a “traffic distribution system,” also known as a TDS.
Click to expand...

The idea is that malware gangs can rent access to Prometheus and receive an account on the TDS platform.

Buyers can then access the account, configure the malware payload they want to distribute, the type of users they want to target (based on details such as geographical location, browser or OS version), and provide a list of hacked web servers.
Click to expand...

Spotted by security firm Group-IB earlier this spring, Prometheus is currently advertised on underground cybercrime forums for prices ranging from 30$ for 2 days of access to the platform to $250 a month.
The Prometheus ad, which dates back to August 2020, suggests the service has been live and used by malware gangs for almost a year.

Group-IB researchers said they discovered several campaigns where malware samples distributed through hacked web servers were bearing the mark and URL schemes of the Prometheus TDS, including some of today’s most dangerous malware strains, such as Campo Loader, IcedID, QBot, SocGholish, and Buer Loader.
Click to expand...

Group-IB: Prometheus TDS - The key to success for Campo Loader, Hancitor, IcedID, and QBot

In the spring of 2021, Group-IB's Threat Intelligence analysts discovered traces of a malware campaign distributing Hancitor. The researchers took an interest in an untypical pattern of the downloader's distribution [...]

Group-IB discovered at least 3,000 targets of separate malware campaigns that make use of the same scheme. By analyzing the list of targets, the experts were able to establish the two most active campaigns. The first targeted individuals in Belgium, and the second targeted companies, corporations, universities, and government organizations in the United States.
Click to expand...

Log in or Sign up

Meet Prometheus, the secret TDS behind some of today’s malware campaigns

guest Guest

Log in or Sign up

Meet Prometheus, the secret TDS behind some of today’s malware campaigns

guest Guest

Useful Searches