CYBERTHREATANALYSIS

By Insikt Group®
November 12, 2021

THE BUSINESS OF FRAUD:

Botnet Malware Dissemination

CYBER THREAT ANALYSIS

Recorded Future analyzed current data from the Recorded Future®
Platform, as well as dark web and open-source intelligence (OSINT)
sources, to review botnets (“not-auto buy” botnets) that facilitate
nefarious activities by threat actors. This report expands upon findings
outlined in “The Business of Fraud: An Overview of How CybercrimeGets Monetized”. It will be of most interest to anti-fraud and network
defenders, security researchers, and executives charged with security
and fraud risk management and mitigation.

Executive Summary
Botnets are networks of computers infected bymalware (such as computer viruses, keyloggers, andother malicious software) that are controlled remotely
by online threat actors to garner financial gain or
to launch attacks on websites or networks. When acomputer is infected by a botnet, it communicates andreceives instructions from command-and-control (C2)computers located around the globe. Many botnets aredesigned to harvest data, such as passwords or phrases,
Social Security numbers (SSNs), credit card numbers,
addresses, telephone numbers, and other personallyidentifiable information (PII). The data is then used fornefarious purposes, such as identity theft, credit cardfraud, spamming or phishing, website attacks, andmalware distribution.

Key Judgments• While IcedID has surged in spam volume,
TrickBot and QakBot have shown much moreconsistency in the volume of spam and infection
traffic pertaining to fraud purposes since
Emotet’s takedown.
• Financially motivated threat actors, nation-state
actors, and APTs in various international regions
will continue to use botnets for fraudulent
purposes to attack targets.
• Underground forum courses on how to best use
botnets will remain popular among threat actors
for the foreseeable future, particularly as theworld becomes increasingly digitized.

1

CTA-2021-1112

Threat Analysis
In a report published by the International Data
Corporation (IDC), researchers predict that “by 2025
there will be 55.7 billion connected devices worldwide,
75% of which will be connected to an IoT platform”.
According to a recent report conducted by Barracuda
Research in September 2021, bots make up nearly twothirds of internet traffic, with malicious bots making
up nearly 40% of all traffic. In today’s cyber threat
landscape, the term “bot” is used widely to describe
automated processes for both legal and malicious
purposes, with examples of these terminologies below:• Spambot: An application designed to gather
email addresses from a variety of websites,
adding them to lists to send unwanted emails.
• Ticket/auto-buy bot: an application that
automatically buys commodities (such as tickets
or retail items), especially commodities thathave limited or special releases. The operatorsof these botnets are usually motivated to resell
items at higher prices on the secondary market.
• Social media bot: an application that specificallyoperates on social networks to post andamplify messages, infiltrate groups, create fakeaccounts, collect postings, and more. Russian
agents successfully deployed social media bots
before the 2016 US Presidential election to stirresentment and spread disinformation.
• Botnet: an infected machine that is controlled
by a threat actor via a command and control(C2) serve with the intent of using the machine(usually with other infected machines) to launch
network disruptions (DDoS), injection malware,
harvest credentials (as in Genesis Store listings),
and other nefarious purposes.
For this report, we will focus on how cybercriminals
use botnets to facilitate their fraudulent activities.

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 1: Comparing reported botnet activity since Emotet’s takedown (Source: Recorded Future)

Background

Outside of basic tutorials or methods for the developmentof a botnet with limited features, statistics across the security
Cybercriminals, as well as nation-state threat actors, havecommunity in 2020 continued to reveal that more prolific strains
continued to demonstrate the flexibility and dynamic aspect ofof malware commonly associated with malicious botnet activity
conducting botnet operations that leverage routers and otherremained the most popular strains affecting all industry verticals
equipment to perform unconventional tasks such as renderingby the end of the year.
devices inoperable or using them to disseminate malware strains
The successful law enforcement takedown of the Emotet
specifically designed to support financially-motivated fraud
botnet has left a void in the loader space. Despite frequent breaks,
activity.
the botnet was one of the most prolific and profitable threats in
Regarding cybercriminals, these threat actors used Emotet,
2019 and 2020. While a large number of malware families use
arguably one of the most popular botnets created until it was
spam and loaders to generate infections, only some of themdisrupted by law enforcement in a January 2021 operation
represent a threat to enterprises because of their capabilities,
and eventually dismantled in April 2021, to download thirdtheir follow-on infection chains to deploy ransomware and theirparty banking malware such as TrickBot, IcedID, and Gootkit.
sheer volume. This eliminates common keyloggers such as
Customers of botnets that cater to cybercriminal entities that
AgentTesla or Formbook and narrows the focus to 4 main botnet
specialize in forms of fraudulent activity include operators offamilies: TrickBot, QakBot, IcedID, and Dridex. There are also
infostealer trojans, business email compromise (BEC) groups, andspecific distribution tools and methods that these botnets use
ransomware gangs. Additionally, tutorials for the development
to supplement or substitute their spam campaigns.
and support of botnets specifically designed to execute malware
Although law enforcement succeeded in taking down thewith functions specifically repurposed to conduct fraudulent
Emotetbotnet, Emotet and TrickBot were suspected to have been
activity such as logging keystrokes (keylogging) remained
operated
for a time by different threat actor groups. However,plentiful within the criminal underground throughout 2020.
TrickBot’s operators have used Emotet as a dropper/loader for
The figure above breaks down the botnet activity of the mosttheir own malware variant. The hosts are being distributed toactive botnets since Emotet’s takedown. After the takedownbrokers and used as initial access vectors for corporate network
in January 2021, the use of the other four main botnets has
compromise and potential distribution of ransomware variants,
increased at varying levels for campaigns targeting victims.
including the Ryuk ransomware variant. 2 malware strains thatwww.recordedfuture.com | Recorded Future ®

CTA-2021-1112

2

CYBER THREAT ANALYSIS
TrickBot’s developers continue to modify and update thehave continued to be observed working in tandem via theoperators of Emotet in 2021 include TrickBot and QakBot, with backdoor, components, and infrastructure, specifically after
the latter suspected of having replaced TrickBot for a time given takedown efforts in the fall of 2020. TrickBot’s operators havethe shift in payloads being deployed onto victim systems to steal split their infrastructure into 2 distinct branches. Each branchbanking information to the appeal of criminals conducting fraud. was built by distinct server types in early 2021, before using
identical but distinct C2 nodes beginning in March 2021. Our
Considered to be the successor to the infamous Dyre banking
visibility indicates the original branch continues to service
trojan, TrickBot banking trojan leverages multiple attack vectors,
TrickBot clients, while the secondary branch has been only used
including redirection attacks and web injects, to attempt to steal
for in-house TrickBot operations. The shift is likely a resiliency
information from financial institutions and initiate fraudulent wire
effort; TrickBot’s operators can continue spamming operationstransfers. The primary methods used by threat actors to distribute
via a secondary botnet branch, even if the more used one getsbanking web injects continue to be phishing and exploit kits, withtaken down or blocked based on the volume of infections.
injects often flourishing within cybercriminal communities thatTrickBot is a sophisticated malware variant, offeringoffer customized options catered to threat actors attempting totarget a specific company. Additionally, administrative panels operators various evasion techniques, as well as different
associated with web injects sold within underground sources methods of spreading, and a large number of capabilities tohave historically been observed promoting features such as the generate revenue for criminal users. One of the primary functionsof TrickBot (similar to other banking trojans) is to lift credentials
inclusion of plugins to connect with botnet infrastructure.
and other sensitive login-related data appealing to financiallyThreat actors continue to generate profit from themotivated threat actors using methods such as web injects and adevelopment or sale of malware strains that incorporate keylogger
keylogging function. As database breaches and login credentials
functionality to steal information of interest, particularly on lowwith passwords have become widely marketed by threat actors,
tier forums that likely attract a broader audience. TrickBot has
keylogging as a standalone attack vector to harvest credentials
previously been co-opted to distribute ransomware and otherthrough the deployment of botnets has become less relevant.
banking trojans, using the botnet formed by a large number ofInformation of interest to threat actors includes usernames,
infections. Despite the United States Cyber Command and thepasswords, personal identification numbers, and possibly
security industry’s attempted disruptions of the TrickBot botnet,
answers to security questions. The role of the malware acting
the controllers associated with the malware have continued toas a loader to download additional payloads of malware cannot
remain resilient.
be overstated.
While TrickBot has made efforts to harden its infrastructure,it has decreased the volume of spam campaigns. TrickBot has
After Emotet’s takedown, QakBot and TrickBot had initially used both BazarCall and Campo distributions as mentioned
surged to a large portion of detections globally. Currently, above, but also relies heavily on its own spam campaigns to
IcedID and Dridex are the most prolific botnet threats. Each of generate infections. TrickBot’s spam operations are often run
them has been observed acting as precursors to ransomware: by affiliates, and TrickBot’s operators provide them with unique
IcedID was linked to Egregor deployments, TrickBot attributed malware samples with embedded G-Tags to track how effectiveby CrowdStrike to the same threat actors that authored Ryuk and the affiliate was to help determine profit sharing.

Botnets and Distribution Methods

Conti ransomware families, Dridex has been tied to DoppelPaymer,
QakBotand QakBot has deployed ProLock and DoppelPaymer.
QakBot is a modular, information-stealing trojan that was first
discovered in 2007 and has recently experienced a resurgence.
TrickBot is a modular banking trojan that has been active QakBot is typically delivered via phishing campaigns and thensince 2016. TrickBot is typically delivered via phishing campaigns executed in memory with multiple plugins being loaded fromand then executed in memory with additional plugins being the malware’s resource section or downloaded. QakBot injects
downloaded at a later point. TrickBot leverages its plugins to gain itself into a running process, typically explorer.exe, to evade
deeper network access, further propagate its spam, and issue defenses. QakBot has multiple modules to help monetize theirmultiple attack vectors for monetization including web injects, intrusions, including those for propagation, web injects, email
password stealing components and the initiation of fraudulent collection, and other data theft. One of the main capabilities
being leveraged by threat actors deploying QakBot is its ability
wire transfers.
to load and run additional malware.

TrickBot3

CTA-2021-1112

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS
QakBot is linked to several affiliates with varied naming IcedID
conventions. The most prolific of these is TR, which, unlike
IcedID, also known as BokBot, is a banking trojan that hasothers, does not get appended with incrementing numbers
been active since 2017. The malware has embedded functionality
for each new campaign. TR-based spam uses hijacked email
to spread to other hosts on the same internal network and uses
threads from prior victims, and is identified with the beaconing
web injects with redirection, as well as cookie and credential
URI structure, which is typically “/ds/<DDMM>.gif”. TR is used tostealer functions for monetization. IcedID is often delivered using
conduct phishing campaigns for other malware families including
phishing, with Microsoft Office documents containing macros
IcedID and has been used to drop Cobalt Strike in DoppelPaymerthat run the subsequent stage of the malware or using hijacked
linked intrusions.
email threads with .zip attachments. IcedID surged in March and
The TR distributor has been linked to the use of the April 2021, with new tactics and increased spam volume, leading
EtterSilent (aka SilentBuilder) malicious document builder, which many to believe it is the current successor to Emotet.
is also used by other criminal syndicates, to build malicious Excel
Unlike other botnets, IcedID does not openly track any of
4.0 macro spreadsheets for distribution.
its clients or users, although we believe its developers operate
SQUIRRELWAFFLE is a lightweight loader first deployed at an affiliate model. IcedID is also less mature in its infrastructure
scale by the TR distributor in September 2021. Shortly after what operational security, continuing to use the same pool of servers
was a likely test phase in early September, SQUIRRELWAFFLE for its operations. Although this is effective in generating
saw international distribution via multi-language spam campaigns infections, it does not display the same maturity as the otherstarting September 20, 2021. These campaigns returned to TR’s families mentioned.
reliance on the EtterSilent document builder. The loader directly
dropped Cobalt Strike Beacons and QakBot modules; the latter
Financially Motivated Cybercrime
was used to facilitate further spam operations.
Cybercriminals have continued to demonstrate flexibility
QakBot regularly cycles the overlaps in affiliate infrastructure,and ingenuity in using botnet operations. Recorded Future
as shown by data from the configuration file included in theanalyzed threat actor dark web posts and publicly reported
malware’s resource section. At the time of analysis, the TR andintelligence to gain insight into which nations and regions appear
Obama affiliates shared 95% of the same infrastructure, distinct
to be particularly targeted by threat actors advertising botnets
from the 95% infrastructure overlap between the Biden andas a service in various languages. During our investigation,
Clinton affiliates. The Abc affiliate operated on a relative island,
Recorded Future found Portuguese, Spanish, Russian, English,
with only 8% overlap with the Biden and Clinton infrastructure.
and Chinese to be among some of the more popular languages
Previously, TR and Biden affiliates had substantial overlap infor conversations about botnets being sold, created, and usedinfrastructure; this cycling is likely to improve resiliency across
to target victims.
the operation.

Dridex

Portuguese and Spanish

Although on January 27, 2021, a global team of law
Dridex is a banking trojan that first appeared in 2014, which
enforcement agencies announced the seizure and takedown
uses web injects, keylogging, and email stealing functions toof Emotet, during its life the majority of Emotet controllers
monetize infections. Different communication modules can be
resolved to IP addresses in Latin American countries. The threatloaded by the malware to facilitate VNC, peer-to-peer (P2P), or
actors behind the infamous botnet (which has evolved from itsother alternative communication messages. Dridex is typicallybeginnings as a banking trojan into a full-service threat delivery
distributed via phishing campaigns as a malicious attachment orservice) were surging in the region, targeting an array of sectors,
link. The malicious attachment often contains macros that oncefrom automotive to finance and retail to technology. While there
opened reach out to a C2 server to download the actual Dridex
are other botnets leveraged in the region, Emotet was heavily
malware. In some instances, Dridex is embedded in the attachedfavored in comparison to other botnets prior to its takedown
file and will be extracted when opened by the user.
among Portuguese and Spanish-speaking threat actors.
Dridex had 4 active affiliates, at the time of analysis, all ofSince its dismantling, Recorded Future analysts have seen
which use a different configuration file embedded in Dridex’s
cybercriminals in Latin America take to underground forums andmain payload. The affiliate IDs are regularly rotated or aged
marketplaces to advertise and sell their self-created as well as
off, making it difficult to track customers or methods used for
popularly known botnets. Below is a sample of events pertaining
distribution over time.
to botnets that have occurred within the past year on Spanish
and Portuguese-speaking threat actors across the criminal
underground:www.recordedfuture.com | Recorded Future ®

CTA-2021-1112

4

CYBER THREAT ANALYSIS

Cybercriminal use of botnets

SourceIntelligence

CrackedThe Portuguese-speaking threat actor“Pleek” posted an advertisement for botnet
tutorials amongst other tools in September
2020 as a hacking package.

CrackedThe Portuguese-speaking threat actor“skandalozem” shared in March 2020 a
botnet that they claim can perform distributed-denial-of-service (DDoS) attacks on
any server.

BovedaForum

The Spanish-speaking threat actor “therealghostcard” advertised their services andproduct for what they claim to be a 100%
functional and stable botnet for android
which includes 24/7 assistance, administration, injections, SMS interceptors, andhidden SMS interceptors.

BovedaForum

The Spanish-speaking threat actor“Design3rK” requested business partnerships and associates to set up a botnet togenerate scams in Spain.

CebollaChan
ForumsThe Spanish-speaking threat actor“leet331” shared a post in which they
sought botnet partners to collaborate andadminister a homemade botnet which
includes modules such as keylogging,screenshot module, and cookie stealer
module.

Table 1: Breakdown of Spanish- and Portuguese-speaking threat actors (Source: Recorded Future)

ChineseOn September 1, 2021, the Record reported that Chinese
authorities had arrested the authors of the Mozi Internetof Things (IoT) botnet. At its peak, the Mozi botnet infected
160,000 systems/day in September 2020 and had historicallyinfected more than 1.5 million different devices, with more thanhalf of them located inside China. The botnet also used the DHT
protocol to create a P2P system between all the infected devices,
allowing bots to send updates and operational instructions toeach other directly, which also permitted Mozi to continue
to operate even without a central C2 server. For this reason,
researchers believe it will take months for the botnet to die
out. In addition, prior to their arrests, new features were added
to the Mozi module which enabled cryptocurrency mining on
infected systems in an attempt to monetize the botnet beyond
DDoS attacks.
Scripts and tutorials for cryptocurrency mining that uses
a botnet are widely offered on Chinese-language dark web
marketplaces. On June 3, 2021, the threat actor “wo98998998”
advertised an offer for the script and tutorial for utilizing a botnet
for cryptocurrency mining on Dark Web Exchange. A similar offer
was posted by the threat actor “456811” on Tea Horse Road
Market on June 4, 2021.
Botnet capability is often packaged with other hacking tools
and offered for purchase across the Chinese-language dark web
ecosystem. On June 11, 2021, the threat actor “409272” offereda toolkit dubbed the “Hack Pack” on Tea Horse Road Market that
included anti-antivirus, password cracker, DDoS, vulnerability
scanner, and other functions. A similar offer was posted by thethreat actor “665317” on Exchange Market on June 17, 2021.

In a telegram post on August 7, 2021, the threat actor“aihacker” stated the sale of the botnet for DDoS started on JulyOn July 21, 2021, the Record reported that China’s APT31 25, 2021, with UDP at 1 T, ACK at 500 G, large packet SYN at 260
has been hijacking home routers to form a proxy botnet around G, and small packet SYN at 140 G. Customers have the option
its server infrastructure to relay and disguise its origins. A to purchase daily, weekly, and monthly DDoS service packages.
security alert published by the French National Cybersecurity
In addition to dark web marketplaces and Telegram,
Agency, also known as ANSSI (Agence Nationale de la Sécurité
advertisements of botnet/DDoS services can often be founddes Systèmes d’Information), listed 161 IP addresses hijacked
on Chinese-language clearnet hacking forums. Below are 2
by APT31 in recent attacks against French organizations. French
advertisement banners from 16hk[.]com. The top one is for “
officials said that APT31’s proxy botnet was used to perform云溪 (Cloud Creek) Specialized DDoS Service”, whose operator
both reconnaissance operations against their targets, but also
claims to have been in operation for 3 years and takes orders
to carry out the attacks themselves.
for DDoS and CC stress testing services. It also lists the QQ
number of 156740798 as a contact. The bottom one is for “孙悟空(Sun Wukong, or Monkey King) DDoS Service”, whose operator
provides L4/L7 DDoS attacks.

APT use of botnets

5

CTA-2021-1112

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 2: Botnet/DDoS service ad banners on the Chinese-language hacking forum 16hk[.]com (Source: Recorded Future)

In addition, we observed possible Chinese-speaking threat
Recorded Future analysts have continued to observe aactors offering botnets on Russian and English-language forums. general shift among cybercriminal and financially motivated
The threat actor “everlongddos” advertised a 700 GBPS UDP threat actors to disrupt business operations, often incorporating
botnet in both Chinese and Russian on the mid-tier Russian DDoS attacks as a secondary tactic or technique to support
language forum Best Hack Forum, with everlongddos offering other threat activities such as the deployment of ransomware
to perform demonstrations for serious customers. There is an onto targets. “UNKN” (alias “Unknown”), an operator of
instance of Chinese-language usage that hinted the threat actor ransomware, historically stated that they like the idea of themight not be a native speaker, but the posting was clearly aimed SunCrypt ransomware group encrypting the files, threatening toexpose the data, and would also launch a massive DDoS attack
toward Chinese-speaking forum users.
against the infrastructure of a victim. In October 2020, UNKN had
admitted that REvil was expanding on this concept, one that was
Englishincorporated by multiple ransomware groups throughout 2021 in
Overall, cybercriminals have continued to demonstrate thea trend reminiscent of the rise of extortion websites. Additions
flexibility and dynamic aspect of a botnet operation by exploiting
such as this continue to demonstrate ransomware operators’routers and other similar devices to perform unconventional
willingness to incorporate features originally adopted by othertasks. Vulnerable IoT devices will likely remain instrumental inransomware crews so long as they have some degree of successbotnet operations, assisting with malware propagation efforts
in generating additional profit.
and attempts by threat actors to disrupt the networks for financial
Despite takedown efforts from law enforcement entities
or political gain. Cybercriminal stresser/booter services areoften sold as Software-as-a-Service (SaaS), with tutorials and worldwide, we continue to observe threat actors on undergrounduser support​ offered. These services provide the user with the forums and clearnet sources advertising a variety of DDoS
software to direct an attack, including control of DDoS method(s). services or tools on a regular basis. Many IoT botnets found on
These stresser services generally incorporate botnets consisting underground forums, and typically sold as separate services,of compromised hosts into the attack service. These services are either based on source code from the Mirai botnet or othercan often cost as little as $10 an hour. Additionally, IP stresser similar malware. As noted by TrendMicro, low-cost rentals
services usually hide the identity of the actual attacker using mean that this type of botnet is readily available to all levels
proxy servers and botnets for an attack, or by spoofing the traffic of cybercriminals, even those that may not have the skills tobuild and run their own botnets. We also noticed that some ofsource in a reflective attack.
these Mirai botnet rentals come with guarantees of protection
General open-source searches for “stresser” and “booter”
against disruption of botnet hosting as part of the service. The
services typically result in dozens of listings including some that
predominant model for earning revenue with these botnets isadvertise DDoS services along with botnets and servers for hire.
still DDoS. However, we do expect cybercriminals to innovate
The accessibility of these services (regardless of the degree
more over time.
of their sophistication) is likely to continue to be appealing
Vulnerabilities, when unpatched or ineffectively mitigated,
for fledgling cybercriminal entities attempting to learn how
to efficiently use a botnet in support of financially motivated can expose IoT devices on the network to outside attacks, suchas use in botnets, network infiltration, data exposure/exfiltration,
criminal activity.
device takeover, and potentially compromise other devices,
including non-IoT devices on the network. Additionally, somevulnerabilities in IoT devices can remain invisible and unpatched
for some time due to their use in proprietary settings leaving thedevices at a high risk of compromise by threat actors.
www.recordedfuture.com | Recorded Future ®

CTA-2021-1112

6

CYBER THREAT ANALYSIS

Figure 3:​Advertisement for “stressers along with botnets’’ available for hire (Source: freestresser[.]to)Figure 4: Discussions regarding IoT technology vulnerabilities within underground source reporting (Source: Recorded Future)

7

CTA-2021-1112

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSISThe price of entry into the Botnets and Bot-Herders School
Several of the top threats associated with IoT devices that
continue to be referenced within underground discussions in September 2021 was $1,400. The courses are taught by 5 to
10 instructors — cybercriminals with a reputation in financial
include:fraud, and OpenCard forum administrators and moderators.
• Exploitation by IoT botnet malware (and being targeted
According to the OpenCard forum administrators, among theby said botnets)
school instructors is a large botnet owner and a professor of a
• Targeting/disruption of network infrastructure associated leading Russian university, and a chairperson of its IT faculty.
with legitimate businesses
The average group of the Botnets and Bot-Herders School• Brand damage through theft (or destruction) of
consists of 40 to 50 individuals with different levels of cybercrime
employee personal or company data targeted by botnets
experience, with most being novice fraudsters looking to build,
distributing malware strains such as ransomware
maintain, and monetize botnets.
The use of IoT technology on a network can greatly reduce
operational costs, mitigate system issues, and improve acrossthe-board efficiencies. However, this innovation comes withunique security risks often resulting from attempts to combine
this technology with legacy systems already functioning withina host environment. Among these risks to IoT systems include:• A lack of uniform security standards in the maintenanceof this technology• Their utilization by building or facility managers rather
than security professionals• Their diverse irregularly secured attack surface allows
threat actors potential access to company servers
storing personal, proprietary, or financial data.
As society continues to place a large emphasis on making
technology more efficient, both from a customer standpoint andan operational perspective, there continue to be security risks
as modern technology is leveraged for convenience purposes
rather than focusing on the end-to-end security of technologies
they are utilizing.

Botnets Training: Inside the Bot-Herders School
In addition to the above botnet activities, Insikt Groupanalysts have identified dark web threat actors offering botnetrelated services, including tutorials and lessons on how to use
botnets in targeting victims. Since 2019, the Russian-language
underground forum OpenCard has been offering a training
course on botnets and bot-herders. OpenCard forum operates
as a marketplace and discussion board focused on carding,
e-commerce fraud, and money laundering. According to thecourse authors, “bot-herders are operators of botnets who use
malware to break into computers and computer networks to forma botnet for personal gain and malicious purposes”.

Figure 5: Botnets and Bot-Herders School. The description reads: “Training. Bot-herding & Logs.
Sign Up” (Source: OpenCard Forum)

The Botnets and Bot-Herders School curriculum consists ofthe following training sessions:
1. Vulnerabilities of corporate networks
2. Examples of attacks on corporate IT infrastructure
3. Malware types and distribution methods
4. Installs: buying and making your own malware
5. Botnets: general concepts, classification,and monetization
6. Preparing, testing, and launching a botnet
7. Practical use cases with examples of successful
botnet operations
8. Botnet security: avoiding closure and law
enforcement attention
9. Web injects and exploits
10. Overview of the current botnet-related market
11. Logs: buying, mining, processing, and monetization
methods

www.recordedfuture.com | Recorded Future ®

CTA-2021-1112

8

CYBER THREAT ANALYSIS

Figure 6: “CustomDrive”, a graduate of the Botnets and Bot-Herders School, brags about stolen cryptocurrency and illegally purchased items using PII and login credentials obtained from
infected users’ computers (Source: WWH Club Forum)

OpenCard forum offers the Botnets and Bot-Herders School
graduates a platform to find partners, and acquire the necessarycomponents for launching and monetizing botnets.
The Botnets and Bot-Herders School instructors suggest
using botnets for:• Stealing PII, financial, and confidential information• Launching DDoS attacks• Adware for showing a contextual advertisement toinfected users, rerouting victims’ internet browsing
to advertisements, and collecting marketing data on
infected users• Cryptocurrency mining, which according to the training
instructors, is less profitable than other above-mentioned
attack vectors

A botnet with 5,000 to 10,000 infected computers, according
to the training instructors, can earn its operator up to $10,000
a day. At the same time, training instructors note that runninga botnet is an expensive, risky, and not necessarily stable• Keylogging to record PII and confidential data, such as
business. Yet, the Botnets and Bot-Herders School is well known
victims’ logins and passwords
in underground communities for enabling novice cybercriminals• Brute-forcing to use multiple infected machines and their to enter the fraud stage. The Botnets and Bot-Herders School
computational power for password cracking
provides instructions on how to build and monetize a botnet• Click-bots for monetization on the advertisement, suchand many graduates choose to use acquired skills for financial
as auto-clicks on supplied URL links
and credit card-related fraud, with some of the graduates using
login and PII data they initially gain from infected computers for
carding and shipment fraud.
• Creating SOCKS v4/v5 proxy servers, for example, formimicking real users, sending spam, and facilitating
payment card and other fraud

9

CTA-2021-1112

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Figure 7: “cinstaller” website offering a platform to earn money from installs and web traffic (Source: cinstaller[.]com)

Using labor/freelance exchanges is a popular method for best for adding quality bots to a botnet. Threat actors pay as
threat actors to infect multiple computers to form a botnet. Some little as $1 per 1 installed piece of allegedly useful program thatlabor/freelance exchanges allow the advertisement of software victims believe they test by downloading and installing whileon their websites. Threat actors use this as means to advertise getting paid for a seemingly easy task. Some of the websites
paid testing of software that is presented as legitimate products used for this method recommended by the Botnets and Botwhereas it is packed with malware. Users who download and Herders School instructors are installunion[.]com, cinstaller[.]
install this software, infect their computers that are turned into com, and installppi[.]com.
bots in a few clicks.
Lotteries and prizes are other popular methods threat
The malware is hidden inside the downloaded files that are actors use to infect multiple computers to form a botnet. For
usually not larger than 30 MB and appears as useful software, this method to work, threat actors can create a business page
such as patches, utilities to enhance computer productivity, on a social network, such as Facebook, draw users to join thefitness applications, programs for accounting, management, IT, page, and make a post offering a lottery or a prize to thoseand many others. A cruel joke is for the threat actors to advertise members who download and install software for testing and/malware-infused software as “cleaners, optimizers, or repair or review purposes. This method requires many steps on the
programs”. Bots or infected machines are sometimes referred to threat actor’s part but is considered better for getting higher
as “installs” across the criminal underground. The most sought- quality bots.
after installs are from the US and the price varies between $500
Another method widely employed by threat actors is toto $800 per 1,000 installs. When infecting targeted computers,
upload a malicious file, for example, listed as a new and popularthreat actors use loaders and crypters to elude anti-virus
computer game, onto a torrent-sharing service. According todetections. The method of using labor exchanges in this fashion
threat actors, this method requires a significant amount of timeis very common but not considered among threat actors as the

www.recordedfuture.com | Recorded Future ®

CTA-2021-1112

10

CYBER THREAT ANALYSIS

We offer over 350 hunting packages that security teams canand maintenance to be successful but often brings high-quality
bots, rich with PII and financial data ready to be pilfered. There use to detect malicious activity based on malware signatures
are many other more and less targeted methods used by the within their network. Due to the consistent shifting of packers
used by the malware, we recommend using our SIGMA rules,
threat actors to infect computers to form a botnet.
which are available to clients, to detect the malware’s behavior
By the end of the Botnets and Bot-Herders School training,in place of static detection.
the new cohort of threat actors know how to find and distribute
Further, we recommend the following mitigation strategies:
malware, infect computers, and form and monetize a botnet.
Some of the trainees form smaller groups to join forces and• Use the Recorded Future Platform to help identify
share experiences of what works and does not work for them
actively exploited vulnerabilities and CVEs thatin bot-herding. Although the contents of the Botnets and Bothave been positively associated with ransomware
Herders School may not always offer the latest tactics, sincevariants, which can help with patch management andtraining instructors are likely to exploit novel methods before
prioritization.
sharing them with the larger criminal underground audience,• Keep systems and software up to date and have athe materials and curriculum of Botnet and Bot-Herders School
reliable and tested backup method.
provide an insight into possible vulnerabilities as well as schemes• Exposed Remote Desktop Protocol (RDP) servers are
and techniques used by threat actors.
abused by threat actors to gain initial access into atarget’s network. If remote access solutions are crucial
Mitigations
to daily operations, all remote access services (such as
Citrix and RDP) should be implemented with two-factor
There are several measures that organizations can implement
or multi-factor authentication.
to significantly reduce the risk of their Internet-enabled
embedded devices from becoming targeted by roaming botnets.
These security measures include:• Protect sensitive files using strong, complex passwords.

• Ensuring that device firmware remains current and up todate at all times• Integrating a virtual private network service• Ensuring that the default manufacturer passwords are
immediately changed upon acquiring a new device andthat any existing devices within your enterprise that
contain default credentials are immediately adjusted• Ensuring that all ports unnecessary to the function of thedevice in question are closed
We proactively detect new botnet C2 servers to help
clients prevent infections in their enterprises. We recommend
automatically ingesting these servers for detection in firewall
and IDS appliances and running them over SIEM logs to correlate
infections. This includes proactive detections for all of the botnet
families mentioned in this reporting.

11

CTA-2021-1112

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS

Outlook
The takedown attempt against TrickBot in the fall of 2020,
and the successful takedown of Emotet in January 2021, haveconvinced botnet operators of the need to diversify. We expect
botnet operators to continue to separate their operational
infrastructure among affiliates to maintain their revenue streams.
They will very likely continue to update their payloads with new
packers, obfuscation techniques, and delivery tools, as they
have always done, but they will likely apply those stealthy habits
to their infrastructure as well. Continually evolving botnets will
represent an ongoing threat to multiple industries due to theirgrowing capability to not only disrupt, but to permanently renderdevices and services inoperable. Recorded Future has continued
to see a growing level of technical sophistication among multiple
threat groups, with entities backed by foreign governments
demonstrating through their actions an interest in leveraging
botnets to target critical infrastructure in both public and private
sectors as well as SCADA/ICS devices.

www.recordedfuture.com | Recorded Future ®

CTA-2021-1112

12

CYBER THREAT ANALYSIS

About Recorded Future
Recorded Future is the world’s largest provider of intelligence for enterprisesecurity. By combining persistent and pervasive automated data collection and analytics
with human analysis, Recorded Future delivers intelligence that is timely, accurate,
and actionable. In a world of ever-increasing chaos and uncertainty, Recorded Futureempowers organizations with the visibility they need to identify and detect threats
faster; take proactive action to disrupt adversaries; and protect their people, systems,
and assets, so business can be conducted with confidence. Recorded Future is trusted
by more than 1,000 businesses and government organizations around the world.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

13

CTA-2021-1112

Recorded Future ® | www.recordedfuture.com