Full Report
An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42.
Analysis Summary
Based on the Unit 42 investigation into commodity infrastructure campaigns, here is the technical summary of the multi-payload attack chain.
# Tool/Technique: YouTube Gaming Lure & Multi-Payload PPI Campaign
## Overview
This campaign utilizes Pay-Per-Install (PPI) networks, SEO poisoning, and YouTube gaming "cracked software" lures to deliver a variety of information stealers and remote access trojans (RATs). The attack targets users looking for game cheats or pirated software, ultimately leading to enterprise network compromise through infected employee devices.
## Technical Details
- **Type:** Malware Campaign / Multi-Payload Delivery
- **Platform:** Windows
- **Capabilities:** Credential theft, cryptocurrency draining, remote command execution, and persistent access.
- **First Seen:** Active campaign identified in mid-2023.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1204.001 - User Execution: Malicious Link
- T1566.002 - Phishing: Spearphishing Link (YouTube descriptions)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys
- **TA0006 - Credential Access**
- T1555.003 - Credentials from Web Browsers
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Multi-Payload Delivery:** Uses a "loader-as-a-service" model to drop multiple distinct malware families (Stealers, RATs, Miners) in a single infection.
- **Obfuscation:** Extensive use of nested archives (ZIP/RAR) and password protection to evade email and gateway scanners.
- **SEO Poisoning:** Leveraging high-traffic YouTube channels to push malicious links to the top of search results.
### Advanced Features
- **Anti-Analysis:** Check for virtual machines (VMs) and sandboxes before executing the final payload.
- **Social Engineering:** Using legitimate-looking "setup.exe" files bundled with large dummy files to bypass automated sandbox analysis (inflated file size).
## Indicators of Compromise
- **File Hashes (SHA256):**
- `3e8a481d96078783d58d97607a759082d20379895c80302660d5c4840e698882` (Initial Loader)
- `a884d6b5e0c8b6b1585d6840615967812953259964598d1a3843588934578321` (Vidar Stealer)
- **File Names:** `Setup.exe`, `Crack_Installer.zip`, `Game_Cheat_v2.1.rar`
- **Network Indicators:**
- `t[.]me/paytopush` (C2/Telegram Channel)
- `185[.]172[.]128[.]90` (C2 Infrastructure)
- `steamcommunity[.]com/profiles/[ID]` (Used for C2 dead-drop resolving)
- **Behavioral Indicators:**
- `cmd.exe` spawning `powershell.exe` to download secondary payloads.
- Creation of hidden folders in `%AppData%` or `%LocalLow%`.
## Associated Threat Actors
- **PPI Affiliates:** Various unnamed groups operating under Pay-Per-Install networks.
- **Lumma Stealer Operators:** Frequently identified as a primary payload in these campaigns.
## Detection Methods
- **Signature-based detection:** Modern EDR/AV solutions detect known variants of Vidar, Lumma, and RedLine stealers.
- **Behavioral detection:**
- Monitoring for suspicious `curl` or `certutil` commands downloading executables from public file-sharing sites (MediaFire, Mega, etc.).
- Alerts for unauthorized modifications to browser profile folders (`Login Data`).
- **Network Monitoring:** Inspecting traffic to known Telegram API endpoints used for data exfiltration.
## Mitigation Strategies
- **Prevention measures:** Implement web filtering to block access to known pirated software/cheat sites and common file-sharing services not required for business.
- **Hardening recommendations:**
- Enforce Application Control/Allowlisting to prevent unknown executables from running in user directories.
- Disable "Auto-fill" for passwords in enterprise browsers.
- User awareness training focusing on the risks of downloading software from YouTube descriptions.
## Related Tools/Techniques
- **Vidar Stealer:** A prominent information stealer often used as the primary payload.
- **Lumma (LummaC2):** An info-stealer that uses sophisticated obfuscation.
- **RedLine Stealer:** A widely available commodity stealer.
- **Amadey Loader:** Often used to manage persistence and botnet communications.