Nevada data center used to distribute Dridex, GandCrab malware right under the FBI's nose

The hacking campaign lasted from May 2018 to last month, Bromium found.

Scammers used data centers located in the United States to launch nasty strains of malware against English-speaking web users, according to Bromium research published Thursday.

The hacking campaign lasted from May 2018 to last month, and included five families of banking trojans, two families of ransomware and three forms of malware meant to collect victims’ personal information. The cybercriminal operation relied on U.S. data centers, with 11 web servers hosted at BuyVM, a virtual private server company in Nevada.

The malware — identified as Neutrino, IcedID, GandCrab, and Dridex, among others — is estimated to have stolen millions from international banks.

The location alone makes this operation unusual, Bromium noted, because hackers typically organize in areas outside the FBI’s reach.

“It was interesting to us that the hosting infrastructure is located in the United States and not a jurisdiction that is known to be uncooperative with law enforcement,” the researchers explained. “One possible reason for choosing a U.S. hosting provider is so that the HTTP connections to download the malware from the web servers are more likely to succeed inside organisations that block traffic to and from countries that fall outside of their typical profile of network traffic.”

Researchers also found evidence that may link this activity to the Necurs botnet. That global crime network has been active for seven years, and used to deliver spam and malware ranging from Dridex to Locky, once found in more than 14 million emails in a single week. The hackers behind Dridex have been using the Necurs botnet to distribute their malware since 2016, the report noted.

“Given the similarities between the campaigns delivering Dridex and the other malware families we identified, it is possible that this collection of web servers is part of the malware hosting and distribution infrastructure used by the operators of the Necurs botnet,” it went on. “All the hosted malware we examined has been linked to high-volume malicious spam campaigns that are consistent with the tactics, techniques and procedures (TTPs) and distribution-as-a-service business model of the Necurs botnet.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure