Threats Tagged 'vps'

A new component of PolarEdge's infrastructure, RPX_Client, has been discovered, revealing insights into the threat actor's relay operations. The investigation uncovered 140 VPS nodes acting as RPX Servers and over 25,000 infected devices serving as RPX Clients. The system uses a multi-hop design to conceal attack sources, with compromised IoT devices and VPS servers forming robust barriers. RPX_Client functions as a jumpserver in the Operational Relay Box (ORB) network, providing proxy services and enabling remote command execution. The analysis also revealed connections between previously known PolarEdge infrastructure and the newly discovered components, confirming the attribution to this threat actor.

MediumMalwareGermanyFranceUnited Kingdom+4#proxy#infrastructure#orb

The SystemBC botnet, composed of over 80 C2s and 1,500 daily victims, primarily targets VPS systems from commercial providers. It creates proxies enabling high volumes of malicious traffic for various criminal threat groups. The network is used by multiple proxy services, including REM Proxy, which offers tiered packages for different cybercriminal needs. SystemBC's infrastructure allows for massive data transfers, with some bots generating over 16 GB of proxy data in 24 hours. The botnet is used for various malicious activities, including brute-forcing WordPress credentials, web-scraping, and supporting ransomware operations. The report highlights the evolving nature of proxy services in the cybercriminal ecosystem and their role in facilitating large-scale attacks.

MediumMalwareGermanyUnited KingdomFrance+4#icedid#vps#cybercrime

APT36, also known as Transparent Tribe, has been observed using VPS provider Contabo to host malicious infrastructure for CapraRAT and Crimson RAT. Their latest tactic involves disguising spyware as the popular messaging app Viber, granting extensive permissions to record calls, read messages, and track location. The investigation traced the infrastructure, identified key Indicators of Compromise, and uncovered the full extent of this Android surveillance campaign. The threat actor employs social engineering tactics to distribute their Android Remote Access Trojans, with lures crafted to align with the RAT's disguise. The malware's capabilities include targeted surveillance, credential theft, and infrastructure abuse, potentially eroding brand trust in legitimate communication platforms.

MediumMalwareGermanyFranceItaly+4#impersonation#android#contabo