2024.09.21. The Fair Economy — PotatoNet, a deep web detection specialist, recently released an analysis of malicious deep web cases, saying malware is being distributed through the deep web.
Malware is no longer the exclusive domain of IT experts. Even programming beginners can easily create and distribute malware with just a few tools. As cybercrime becomes increasingly mainstream, its scale and impact are growing exponentially.
Countless pieces of malware can be found on the deep web.
The deep web refers to hidden areas of the web that cannot be accessed by standard search engines, distinct from the dark web. Malicious deep web sites exploited in cyberattacks differ from the dark web in that they can be accessed through a web browser using conventional methods, allowing users to download malware simply by clicking.
Malicious attackers are exploiting the deep web to distribute malware. Hidden malware is typically not visible and cannot be discovered through links connected to normal legitimate websites.
To verify these facts, PotatoNet recently analyzed cases of malicious deep web sites.
The first malicious deep web site analyzed was 'https://e***s.ro'.
When accessing the website, a blank page with no content is displayed. However, the source code contains numerous phishing site links disguised as surveys. The phishing links are hidden using a display:none setting so they are not displayed. These phishing links repeatedly appear and disappear until one moment when a phishing link becomes active.
The website disguised as a blank page contained deep web malware. Malware is automatically downloaded via the URL delivered to the user. Analysis of the downloaded files such as "ord.exe" or "kin.exe" showed that they attempt to escalate privileges on the user's PC and steal sensitive data such as PC details. This is a type of trojan (Trojan/Win32.Formbook) that uses the collected information to control the system.
The next malicious deep web site analyzed was 'https://file*****.vercel.app'.
This website operates using a hosting service called Vercel. The main page displays a '404 error' indicating that the webpage cannot be displayed, and internal site content cannot be verified.
The deep web of this website contained the 'windows.exe' malware. This malware executes a malicious payload and evades antivirus detection through obfuscation and user activity monitoring. It also collects PC details to steal sensitive data. It is a Trojan (trojan/lummastealer) type that receives commands through encrypted channels to control the system.
This malware is judged to have exploited Vercel's free hosting service. Free hosting services provide an environment where attacks can be sustained from multiple IP addresses and various locations without cost burden. Therefore, in the case of hosting services that do not require thorough identity verification, attackers can maintain anonymity while distributing malware.
Both analyzed websites are distribution points for deep web malware and could also be exploited as C&C servers.
PotatoNet said, "Because the deep web is not as easy to track as the regular web, detecting and blocking malware is much more difficult. As seen in the analysis cases above, sophisticated security strategies and close attention are needed to track and block malware hidden on the deep web. Security experts must establish continuous monitoring and countermeasures against malware hidden on the deep web. It is important to watch for new routes where malware is covertly distributed and to analyze the patterns of attackers operating on the deep web. It is essential to block these threats in advance through security reinforcement and preventive measures."
0 Comments
No comments yet.