TDS Enables Koobface Botnet to Earn Bigger Profit

The Koobface botnet, popularly known for using pay-per install and pay-per click mechanisms yearning huge amount for its masterminds has recently been upgraded with a classy traffic direction system (TDS). The TDS controls all the traffic that are related to affiliated websites, reports security researchers at security firm, Trend Micro.

The TDS feature forwards the traffic into various other locations and proves to be helpful in gaining hefty amount for the crooks through access into specific sites.

With Google going stricter with their creation of botnets that combats creation of fake e-mail accounts by spammers, cyber criminals are taking privilege of Yahoo mail for the accomplishment of their task.

Immediately, once the creation of the e-mail accounts is over, innumerable other accounts are created on social networking sites, such as FC2, Tumblr, FriendFeed, Twitter, livedoor, So-net, and Blogger.

As the process continues, images are gathered through a novel binary component, which collects pictures of celebrities, cars and any other images that might attract innocent users.

In the last stage, the botnet generates blog posts that are conducted through a malware component creating blog accounts, whereas the others recover matters or blog posts that are stored in the proxy command-and-control (C&C) server.

These posts are uploaded automatically to the intended platforms. The posts are comprised of links, images, and keywords, which aids in increasing the sites' search engine optimization (SEO) ranking, together with an obfuscated JavaScript code that conceals the references of TDS domain of the botnet.

As a result, the TDS can easily follow the visits to each of the blog post and redirect the visitors to the sites that are affiliated by the botnets. The botnet helps in earning money through the clicks made by victims while they are reading blog posts and also from the traffic that the TDS directs to the chosen final landing sites.

However, for increasing the traffic to the nasty blog posts further, the Koobface gang also circulates keywords on the Web that are inter-related and promotes the posts through various social networking websites. These are undertaken with the assistance of numerous binary components that are catered by each site, as reported by security researchers at Trend Micro.

Related article: TDSS Rootkit Technologies Back

» SPAMfighter News - 12/30/2011