Security Experts:

Connect with us

Hi, what are you looking for?



Adware Spreads With Mevade Malware Linked to Tor Surge

Adware is being spread alongside Mevade malware variants hitting users in the U.S. and Japan, according to Trend Micro.

Adware is being spread alongside Mevade malware variants hitting users in the U.S. and Japan, according to Trend Micro.

The Mevade malware was recently connected to a sudden surge in the number of Tor users during the last month. As it turned out, Mevade downloaded a Tor component on infected computers, possibly as a backup mechanism for its command and control communications.

“In addition to the Mevade malware itself, we saw that ADW_BPROTECT had also been downloaded onto affected systems,” blogged Roddell Santos, threats analyst at Trend Micro. “This is expected for Mevade, as we noted earlier that it is linked to cybercriminals responsible for the distribution of adware. This downloading of adware is consistent with our findings that the Mevade botnet is possibly monetized via installing adware and toolbars.”

According to Trend Micro, a batch of Mevade samples the company’s researchers analyzed were downloaded by a malicious file named FlashPlayerUpdateService.exe (detected by Trend Micro as TROJ_DLOADE.FBV) – which is the same file name as the legitimate file. However, the real updater file is signed by Adobe Systems, whereas the malicious one is not. In addition, the version numbers are different.

“The backdoor communicates to its C&C server via HTTP to receive commands, which include updating a copy of itself and connecting to a specific location using SSH to secure its communication,” Santos blogged.

“As for TROJ_DLOADE.FBV, we’ve found that the URLs it uses to access its C&C servers has the following pattern:

  • http://{malicious domain}/updater/{32 random hexadecimal characters}/{1 digit number}

The IP addresses that host these C&C servers are located in Russia, though TROJ_DLOADE.FBV was found in multiple countries, with Japan and the United States being hit the hardest.

As for Mevade, most of the victims (95 percent) are located in the United States.

Santos recommended that users observe best practices and avoid visiting suspicious sites and downloading files. In addition, users should keep their software up-to-date. 

Written By

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.


Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.