Forest Global Training Partners

Cyber Risks · Krebs on Security

This Service Helps Malware Authors Fix Flaws in their Code

Summary: A Russian-language security site called Krober[.]biz, run by an administrator using the alias "RedBear," sells code reviews to malware authors and buyers that promise to find backdoors and harden their products, with flaws published only after they are patched. RedBear points to almost a dozen Krober articles detailing flaws in tools including the Black Energy DDoS bot panel, Smoke and Andromeda bot loaders, the RMS and Spyadmin trojans, and a loan scam script, and his partners have included the Exploit[.]in figures "upO" and "Lebron."

Why it matters: The same actors who build the malware are paying for quality assurance on it, and researchers tie the "Lebron" identity to GandCrab and REvil, an operation that bragged about extorting billions of dollars from hacked businesses before it closed in June 2019.

Read the original at Krebs on Security ↗

Topics
Malware
Related