Check Point Research has revealed a new malware Electron-bot that is actively being distributed through Microsoft's official store.
With more than 5000 machines already affected in 20 countries so far, the malware continually executes attacker commands, such as controlling social media accounts on Facebook, Google and Sound Cloud. The malware can register new accounts, log in, comment on and "like" other posts.
CPR urges users to immediately delete applications from a number of publishers.
Dubbed Electron-bot by CPR, the malware's full capabilities include SEO poisoning, an attack method in which cybercriminals create malicious websites and use search engine optimisation tactics to make them show up prominently in search results. This method is also used as a sell as a service to promote other websites ranking.
The malware also utilises Ad Clicker, a computer infection that runs in the background and constantly connects to remote websites to generate 'clicks' for advertisement, hence profiting financially by the amount of times an advertisement is clicked.
It can promote social media accounts, such as YouTube and SoundCloud to direct traffic to specific content and increase views and ad clicking to generate profits, as well as promote online products, to generate profits with ad clicking or increase store rating for higher sales.
In addition, as Electron-bot's payload is dynamically loaded, the attackers can use the installed malware as a backdoor in order to gain full control on the victim's machine.
"This research analysed a new malware called Electron-bot that has attacked more than 5000 victims globally," says Daniel Alima, Malware Analyst at Check Point Research.
"Electron-bot is downloaded and easily spread from the official Microsoft store platform. The Electron framework provides Electron apps with access to all of the computer resources, including GPU computing.
"As the bot's payload is loaded dynamically at every run time, the attackers can modify the code and change the bots behaviour to high risk," he says.
"For example, they can initialise another second stage and drop a new malware such as ransomware or a RAT. All of this can happen without the victim's knowledge. Most people think that you can trust application store reviews, and they don't hesitate to download an application from there.
"There's incredible risk with that, as you never know what malicious items you can be downloading."
Distribution via Gaming Apps on Microsoft Store
There are dozens of infected applications in Microsoft store. Popular games such as "Temple Run" or "Subway Surfer" were found to be malicious. CPR has detected several malicious game publishers, where all the applications under those publishers are related to the malicious campaign:
- Lupy games
- Crazy 4 games
- Jeuxjeuxkeux games
- Akshi games
- Goo Games
- bizon case
Victims
So far, CPR counted 5000 in 20 countries. Most of the victims are from Sweden, Bermuda, Israel and Spain.
How the Malware Works
The malware campaign works in the following steps:
The attack starts with installation of a Microsoft store application pretending to be legitimate
After the installation, the attacker downloads files and executes scripts
The malware, which has been downloaded, gains persistence on the victim's machine, repeatedly executing various commands sent from the attacker C-C
To avoid detection, most of the scripts controlling the malware are loaded dynamically at run time from the attackers' servers. This enables the attackers to modify the malware's payload and change the bots' behaviour at any given time, CPR says. The malware uses the Electron framework to imitate human browsing behaviour and evade website protections.
Attribution
There is evidence that the malware campaign originated in Bulgaria, including:
- All variants between 2019 - 2022 were uploaded to a public cloud storage "mediafire.com" from Bulgaria
- The Sound Cloud account and the YouTube channel the bot promotes are under the name "Ivaylo Yordanov," a popular Bulgarian wrestler / soccer player
- Bulgaria is the most promoted country in the source code
CPR has reported to Microsoft all detected game publishers that are related to this campaign.
Safety Tips
In order to stay safe as much as possible, before downloading an application from the App store:
- Avoid downloading an application with small amount of reviews
- Look for applications with good, consistent and reliable reviews
- Pay attention to suspicious application naming which is not identical to the original name
