Malware increase-website-traffic1

1628 Views | Published on December 30th, 2015

ProxyBack Malware Converts Your PC Into Proxy

PALO ALTO NETWORKS RESEARCHERS HAVE IDENTIFIED A UNIQUE MALWARE THAT INFECTS HOME PCS AND TRANSFORMS THEM INTO INTERNET PROXIES USING HTTP TUNNEL.

As per Palo Alto researchers, a Russian company’s domain is being used by attackers, which inherently is a patent Web proxy service.

The malware has been named ProxyBack and it was firstly discovered in March 2014 but its functioning has only recently been understood by researchers.

▼Advertisements

Palo Alto Networks experts believe that most educational institutes located in Europe have become the targets of this malware and regular home-use PCs are attacked for funneling internet traffic illegally.

These infected PCs aren’t used to hide the location of a hacker but are advertised as trusted proxy servers listed in an online proxy service that operate from Russian outskirts.

ProxyBack performs its task by firstly infecting a PC and creating a connection with the attacker controlled proxy server from where it receives commands and also the traffic that is to be routed to real web servers.

Every PC that ProxyBack infects becomes a bot inside a bigger network that is already being controlled by the attackers, who then send instructions through basic HTTP requests.

  1. Until 23rd December 2015 ProxyBack has infected 11,149 computers.
  2. Every infected machine is given a unique ID parameter in the HTTP requests that are being sent from the C&C server.
  3. This number slowly gets incremented by one for every single machine.

Though the researchers couldn’t find any reliable electronic trail to identify the perpetrators that use the buyproxy.rudomain but they have discovered that IPs of some of the infected machines did appear in their online advertisement as IPs of some of the available proxy servers.

▼Advertisements

Jeff White from Palo Alto Networks says:

“Whether the people behind ‘buyproxy[.]ru’ are responsible for the distribution of the ProxyBack malware or not is unknown; however, it is clear that the ProxyBack malware is designed for, and used in, their service.”

In the past, Palo Alto researchers exposed hackers exploiting Kaspersky and Microsoft products to install snooping malware on users PCs. The firm also identified YiSpecterWireLurker andXcodeGhost malware in iOS devices .

Share on Facebook0Share on Google+0Tweet about this on TwitterShare on Reddit0Email this to someonePrint this pageShare on StumbleUpon0Digg thisPin on Pinterest0Share on LinkedIn0




Leave a Reply

Your email address will not be published. Required fields are marked *

Back to Top ↑

You Might Also Like:
Second Flash Player Zero-day Exploit found in ‘Hacking Team’ Dump

Another Flash zero-day exploit has emerged from the hundreds of gigabytes of data recently leaked from Hacking Team, an Italian...

Close