Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Squirt Danger: The Swiss Army Knife Malware from Veteran Malware Author The Bottle

Summary: Unit 42 researchers identified a C# botnet malware family they call SquirtDanger, attributed with strong evidence to a prolific Russian malware author known as TheBottle, and found roughly 400 samples carrying an embedded campaign identifier out of 1,277 unique samples seen across multiple campaigns. The malware persists through a scheduled task named 'CheckUpdate' that runs every minute, communicates with its command and control server over raw TCP, and can steal browser passwords, locate cryptocurrency wallets, and swap clipboard wallet addresses for the attacker's own.

Bottom line: Researchers counted 119 unique C2 servers and 52 unique IPs or domains used as delivery infrastructure, some of them compromised legitimate websites, with victims including a Turkish university, an African telecommunications company, and a Japanese ICT provider in Singapore. The author behind it also sits in a Telegram channel of roughly 900 members trading botnet access and builders, so the tooling and the operators around it are not going away.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related