Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Filmkan: Mysterious Turkish Botnet Grows Through Facebook

Summary: Unit 42 designated as "Filmkan" a malware spread through Facebook posts that lured users with a fake pornographic video and then a fake Flash Player update, with researcher Mohammad Faghani estimating over 100,000 infections from the likes the malware generated. The dropper, built with AutoHotkey and hosted on Google cloud storage, installs a Chrome extension that pulls JavaScript from three command-and-control servers, blocks security-related domains, and can be updated by the attacker at any time; WildFire first collected samples on January 22 and has gathered 44 distinct samples.

Bottom line: The attacker assembled a botnet of more than 100,000 users in a short window without exploiting a single software vulnerability, relying only on social engineering, and the three C2 domains are the one point where shutting them down simultaneously would cut the attacker off from the whole botnet.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related