Undetected For Years, Stantinko Malware Infected Half a Million Systems

A massive botnet that remained under the radar for the past five years managed to infect around half a million computers and allows operators to “execute anything on the infected host,” ESET researchers warn.

Dubbed Stantinko, the botnet has powered a massive adware campaign active since 2012, mainly targeting Russia and Ukraine, but remained hidden courtesy of code encryption and the ability to rapidly adapt to avoid detection by anti-malware solutions.

Targeting users looking for pirated software, the actors behind the malware use an app called FileTour as the initial infection vector. The program installs a variety of programs on the victim’s machine, while also launching Stantinko in the background.

The massive botnet is used mainly to install browser extensions that in turn perform ad injections and click fraud, but malicious Windows services are used to execute a broad range of operations: backdoor activities, searches on Google, and brute-force attacks on Joomla and WordPress administrator panels, ESET reveals.

The threat also installs two malicious Windows services after compromise, each with the ability to reinstall the other if deleted. Because of this, successful disinfection requires both services to be deleted at the same time. If not, a new version of the deleted service could be provided by the command and control (C&C) server, researchers say.

The malicious browser extensions installed by Stantinko are called The Safe Surfing and Teddy Protection, both distributed through the Chrome Web Store and seemingly legitimate apps that block unwanted URLs. When installed by the botnet, however, the extensions receive a configuration to perform click fraud and ad injection.

Stantinko is a modular backdoor that includes a loader to execute any Windows executable sent by the C&C server directly in memory. Courtesy of a flexible plugin system, the malware’s operators can execute any code on an infected system.

Known plugins include Brute-force (performs distributed dictionary-based attacks on Joomla and WordPress administrative panels), Search Parser (performs massive distributed and anonymous searches on Google to find Joomla and WordPress websites and uses compromised Joomla websites as C&C servers), Remote Administrator (backdoor that implements a full-range of actions, from reconnaissance to data exfiltration), and Facebook Bot (performs fraud on Facebook: can create accounts, like pictures or pages, and add friends).

The malware’s operators are focused on making money mainly through click fraud. The actors are also believed to be very close to the advertisers, as users would sometimes reach the advertiser’s website directly after the Stantinko-owned ad network.

“On the other hand, traditional click-fraud malware relies on a series of redirections between several ad networks to launder their malicious traffic. This shows that not only are the Stantinko operators able to develop highly stealthy malware, but they are also able to abuse the traditional ad-serving economy without getting caught,” ESET points out.

The group behind the botnet is also trying to fraudulently access administrative accounts of Joomla and WordPress websites and resell the account logins on the underground market. Furthermore, the actors also engage into social network fraud through a plugin capable of interacting with Facebook (courtesy of botnet’s size, it is difficult for Facebook to detect this type of fraud).

“Even though it isn’t noticeable to the user, due to the absence of CPU intensive tasks, Stantinko is a major threat, as it provides a large source of fraudulent revenue to cybercriminals. Moreover, the presence of a fully featured backdoor allows the operators to spy on all the victimized machines,” the security researchers conclude.

Related: Botnet of Thousands of Servers Mines for Crypto-Currency

Related: Thousands of Devices Hacked by Rakos Botnet

Related: New “Ghost Host” Technique Boosts Botnet Resiliency