Pro-Russian Videos Inflated Falsely on DailyMotion - Trustwave

According to security vendor Trustwave, some number of views of some pro-Russian videos on the website Dailymotion was elbowed by a botnet designed for Web advertising fraud.

Reseller.co.nz published news on 1st May, 2015 quoting Rami Kogan, Security Researcher with Trustwave, as saying "Investigation seemed to be strictly for ad fraud but it was found to be having a political angle which becomes surprising."

He wrote: "We don't know who is behind this fake promotion of video clips but it seems to have political interest."

This is not the first time that botnets being used to expand the number of views on videos but Kogan wrote:"we have observed this tactic for the first time to promote video clips with a plan apparently having political issue."

Russia forcibly captured Crimea from Ukraine last year which was promoted by one of the videos. Others also dealt with political and military issues of Russia although some had no connection with Russia. The videos now apparently have been removed from by DailyMotion.

Experts of Trustwave say that all suspicious videos share the same traits: they all have a fairly more number of views (around 320K with most of them within each other's minutes away) but without shares on social media or comments. The fraudsters also make the video more visible to other users of the site of the video by falsely increasing the popularity of the clip.

Csoonline.com published news on 29th April, 2015 quoting Ziv Mador, VP of Trustwave, as saying "Unfortunately computers visiting falsely inflated videos got affected with a Trojan known as Bedep which is normally used for click fraud."

According to their analysis, the malware is trained to create a concealed virtual desktop on the compromised computer where a full-blown Internet Explorer is installed. Moreover, some of the pages loaded this way distributed Neutrino and Magnitude which are other two exploit kits.

Softpedia.com reported on 4th May, 2015 quoting Kogan as saying "It seems that the people behind this particular C&C are attempting to increase their profit by selling traffic from compromised computers to other campaigners which look for spreading their own malware through Neutrino and Magnitude."

» SPAMfighter News - 5/11/2015