Forest Global Training Partners

Cyber Risks · Cisco Talos

Attracting flies with Honey(gain): Adversarial abuse of proxyware

Summary: Cisco Talos identified a malware family that drops a patched Honeygain proxyware client, an XMRig miner and an information stealer, and appears to be evolving to add a Nanowire client. In one campaign, an attacker bundled a legitimate signed Honeygain installer with mining malware via Smart Install Maker, used two scheduled tasks and a Windows service for persistence, and redirected victims to a Honeygain referral landing page.

Why it matters: Talos notes that no tracking mechanisms equivalent to those used for Tor exit nodes exist for proxyware network nodes, so attacks routed through these residential connections appear to originate from users' networks and are harder to analyze and respond to. Endpoints running these clients can put corporate networks on reputation-based blocklists and open a tunneled path that may bypass perimeter inspection.

Read the original at Cisco Talos ↗

Topics
Malware
Related