Menu
Sefnit click fraud malware drops Tor for SSH, Facebook researchers say

Sefnit click fraud malware drops Tor for SSH, Facebook researchers say

The malware program that flooded the Tor network with new clients last year is back, but now uses SSH for command and control

Security researchers from Facebook have identified a new variant of the Sefnit click fraud malware program that uses SSH for command and control instead of the Tor anonymity network.

The threat, which is also known as Mevade, infected millions of computers last year and caused a sudden spike in Tor usage.

Sefnit is a family of malware programs that has been used to defraud advertisers by generating rogue ad clicks since at least 2011, according to an analysis in September by researchers from the Microsoft Malware Protection Center.

In mid-August, a Sefnit variant called Mevade caused the number of daily users on the Tor anonymity network to rise from around 500,000 to over 3 million because it used a Tor Hidden Service -- a website accessible only from inside the Tor network -- as a command-and-control (C&C) server.

Unlike older Sefnit variants that hijacked user clicks on search results, Mevade used a different click fraud technique that involved transforming infected computers into proxies for routing fraudulent ad click traffic.

It's not clear how well Tor worked as a C&C channel for Mevade's authors given that traffic over the anonymity network can be slow, especially when overcrowded with clients. Poor performance might explain why a new version of Sefnit recently analyzed by researchers at Facebook no longer relies on Tor.

Instead, the new variant uses the Plink (PuTTY link) command-line network connection tool to access C&C servers over the SSH (Secure Shell) protocol, the Facebook Security Team said Monday in a blog post that contains details about the new threat.

The use of Plink further indicates that Sefnit's authors have a tendency to repurpose legitimate software for their goals. This behavior was previously observed with Tor and 3proxy, a free proxy server program.

"This post references additional files, domains and artifacts, including the SSH functionality in channel.dll," the Facebook researchers said. "We hope these details and indicators help security teams audit their assets for signs of Sefnit."

Read more: Purple WiFi partners with Wavelink


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags MicrosoftmalwareFacebookonline safety

Featured

Slideshows

Leading female front runners of the Kiwi ICT industry honoured at 2019 WIICTA

Leading female front runners of the Kiwi ICT industry honoured at 2019 WIICTA

Reseller News has honoured the leading female front runners of the New Zealand ICT industry at the 2019 Women in ICT Awards (WIICTA) in Auckland. The awards recognised standout individuals across six categories, spanning Entrepreneur, Rising Star, Shining Star, Community, Technical and Achievement. Photos by Gino Demeer.

Leading female front runners of the Kiwi ICT industry honoured at 2019 WIICTA
Reseller News kicks off awards season in 2019 with Judges' Lunch

Reseller News kicks off awards season in 2019 with Judges' Lunch

The 2019 Reseller News Innovation Awards has kicked off with the Judges Lunch in Auckland with 70 judges in the voting panel. The awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors. Photos by Christine Wong.

Reseller News kicks off awards season in 2019 with Judges' Lunch
Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomed 2018 inductees - Chris Simpson, Kendra Ross and Phill Patton - to the third running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing landscape of the technology industry in New Zealand, while outlining ways to attract a new breed of players to the ecosystem. Photos by Gino Demeer.

Reseller News welcomes industry figures for 2019 Hall of Fame lunch
Show Comments