Summarizing Webroot's Threat Blog Posts for July

The following is a brief summary of all of my posts at Webroot's Threat Blog for July, 2013. You can subscribe to Webroot's Threat Blog RSS Feed, or follow me on Twitter:

01. Cybercriminals experiment with Tor-based C&C, ring-3-rootkit empowered, SPDY form grabbing malware bot
02. Deceptive ads targeting German users lead to the ‘W32/SomotoBetterInstaller’ Potentially Unwanted Application (PUA)
03. Newly launched underground market service harvests mobile phone numbers on demand
04. Novel ransomware tactic locks users’ PCs, demands that they participate in a survey to get the unlock code
05. Spamvertised ‘Export License/Invoice Copy’ themed emails lead to malware
06. Cybercriminals spamvertise tens of thousands of fake ‘Your Booking Reservation at Westminster Hotel’ themed emails, serve malware
07. New commercially available mass FTP-based proxy-supporting doorway/malicious script uploading application spotted in the wild
08. Fake ‘iGO4 Private Car Insurance Policy Amendment Certificate’ themed emails lead to malware
09. Tens of thousands of spamvertised emails lead to the Win32/PrimeCasino PUA (Potentially Unwanted Application)
10. Spamvertised ‘Vodafone U.K MMS ID/Fake Sage 50 Payroll’ themed emails lead to (identical) malware
11. New commercially available Web-based WordPress/Joomla brute-forcing tool spotted in the wild
12. Rogue ads targeting German users lead to Win32/InstallBrain PUA (Potentially Unwanted Application)
13. Yet another commercially available stealth Bitcoin/Litecoin mining tool spotted in the wild
14. Deceptive ‘Media Player Update’ ads expose users to the rogue ‘Video Downloader/Bundlore’ Potentially Unwanted Application (PUA)
15. Newly launched ‘HTTP-based botnet setup as a service’ empowers novice cybercriminals with bulletproof hosting capabilities
16. Fake ‘Copy of Vodafone U.K Contract/Your Monthly Vodafone Bill is Ready/New MMS Received’ themed emails lead to malware
17. Rogue ads lead to the ‘Free Player’ Win32/Somoto Potentially Unwanted Application (PUA)
18. How much does it cost to buy one thousand Russian/Eastern European based malware-infected hosts?
19. Custom USB sticks bypassing Windows 7/8's AutoRun protection measure going mainstream
20. DIY commercially-available ‘automatic Web site hacking as a service’ spotted in the wild

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Instagram Under Fire as Cybercriminals Release New DIY Fake Account Registration/Management/Promotion Tool

In 2013, CAPTCHAs represent an outdated approach for a Web site wanting to prevent the efficient and systematic abuse of its services.

This fact, largely driven by the rise of cost-effective CAPTCHA solving solutions offered by low-waged individuals internationally over the last couple of years, continues to empower virtually anyone possessing the right cybercrime-friendly tools, with the ability to abuse any major Web property in a potentially fraudulent or malicious way.

In this post, I'll profile one of the most recently released DIY fake account registration/management/promoting tool, targeting Instagram, highlight its core features, as well as emphasize on the true impact that these tools are having on some of the world's most popular Web properties.

Sample screenshots of the tool in action:

Some of its core features are:

• support for multi-threads
• set number ot accounts to generate using a single proxy (malware-infected host)
• randomization of the posted bogus content to avoid easy detection of the pattern
• male/female fake account creating capabilities
• mass account validity checking capabilities
• CAPTCHA-solving integration with third-party CAPTCHA solving services

Over the years, I've been extensively profiling campaigns utilizing purely legitimate infrastructure for achieving the fraudulent/malicious objectives set by the cybercriminal behind the campaign. These cases demonstrate that cybercriminals continue to pursue the efficient and systematic abuse of legitimate Web properties, which on the other hand, continue relying on CAPTCHA challenges to differentiate between bots and humans using the site, forgetting that it's actually humans solving the CAPTCHAs for the their customers.

Known cases of abuse of legitimate infrastructure for fraudulent/malicious purposes over the years include:
Bogus "Shocking Video" Content at Scribd Exposes Malware Monetization Scheme Through Parked Domains
Fake Codec Serving Domains from Digg.com's Comment Spam Attack
Bogus LinkedIn Profiles Redirect to Malware and Rogue Security Software
Dissecting the Bogus LinkedIn Profiles Malware Campaign
From Ukraine with Scareware Serving Tweets, Bogus LinkedIn/Scribd Accounts, and Blackhat SEO Farms
Celebrity-Themed Scareware Campaign Abusing DocStoc and Scribd
Celebrity-Themed Scareware Campaign Abusing DocStoc
From Ukraine with Bogus Twitter, LinkedIn and Scribd Accounts
Pharmaceutical Spammers Targeting LinkedIn

Instagram Under Fire as Cybercriminals Release New DIY Fake Account Registration/Management/Promotion Tool

In 2013, CAPTCHAs represent an outdated approach for a Web site wanting to prevent the efficient and systematic abuse of its services.

This fact, largely driven by the rise of cost-effective CAPTCHA solving solutions offered by low-waged individuals internationally over the last couple of years, continues to empower virtually anyone possessing the right cybercrime-friendly tools, with the ability to abuse any major Web property in a potentially fraudulent or malicious way.

In this post, I'll profile one of the most recently released DIY fake account registration/management/promoting tool, targeting Instagram, highlight its core features, as well as emphasize on the true impact that these tools are having on some of the world's most popular Web properties.

Sample screenshots of the tool in action:

Some of its core features are:

• support for multi-threads
• set number ot accounts to generate using a single proxy (malware-infected host)
• randomization of the posted bogus content to avoid easy detection of the pattern
• male/female fake account creating capabilities
• mass account validity checking capabilities
• CAPTCHA-solving integration with third-party CAPTCHA solving services

Over the years, I've been extensively profiling campaigns utilizing purely legitimate infrastructure for achieving the fraudulent/malicious objectives set by the cybercriminal behind the campaign. These cases demonstrate that cybercriminals continue to pursue the efficient and systematic abuse of legitimate Web properties, which on the other hand, continue relying on CAPTCHA challenges to differentiate between bots and humans using the site, forgetting that it's actually humans solving the CAPTCHAs for the their customers.

24/7/365.

Known cases of abuse of legitimate infrastructure for fraudulent/malicious purposes over the years include:

• Bogus "Shocking Video" Content at Scribd Exposes Malware Monetization Scheme Through Parked Domains
• Fake Codec Serving Domains from Digg.com's Comment Spam Attack
• Bogus LinkedIn Profiles Redirect to Malware and Rogue Security Software
• Dissecting the Bogus LinkedIn Profiles Malware Campaign
• From Ukraine with Scareware Serving Tweets, Bogus LinkedIn/Scribd Accounts, and Blackhat SEO Farms
• Celebrity-Themed Scareware Campaign Abusing DocStoc and Scribd
• Celebrity-Themed Scareware Campaign Abusing DocStoc
• From Ukraine with Bogus Twitter, LinkedIn and Scribd Accounts
• Pharmaceutical Spammers Targeting LinkedIn

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.