This is exactly what GuardedID, MobileTrust and CryptoDefender protect us from:
Cybercrime , Cybercrime as-a-service , Fraud Management & Cybercrime
Here's Why 'Raccoon' Infostealer Is Popular With Criminals
Cheap and Simple 'Malware as a Service' Sold in Cybercriminal Underground
Scott Ferguson (@Ferguson_Writes) • October 25, 2019
Here's Why 'Raccoon' Infostealer Is Popular With Criminals
(Source: Nick Varvel via Flickr/CC).
The "Raccoon" infostealer, first spotted in the wild earlier this year, is rapidly gaining in popularity on underground forums due to its low cost and ability to steal a wide range of data, including credit card numbers and cryptocurrency wallets, according to a new analysis from Cybereason.
See Also: Live Webinar | Empowering Your Human Firewall: The Art and Science of Secure Behavior
What Raccoon lacks in sophistication it makes up for in ease of use, according to Cybereason. Developed on a malware-as-a-service model, cybercriminals only need access to a Tor-hosted control panel to initiate attacks using Raccoon against whatever target they pick, according to the analysis.
The infostealer sells for $175 to $200, and it's typically delivered through the Fallout or RIG exploit kits, says Assaf Dahan, senior director and head of threat research at Cybereason.
Cybercriminals have also used phishing emails with malicious Office documents that hide macros to deliver and install Raccoon on different devices. Or, they've bundled Raccoon with legitimate software , researchers say.
Demand for New Tools
"There is a big market and even bigger demand in the underground communities for new malware and new tools," Dahan tells Information Security Media Group.
"When it's bundled with good service, an 'easy to use' interface and a reasonable price, it draws the attention of a wide range of clientele. The malware-as-a-service model is quite appealing for cybercriminals who don't necessarily possess the technical skills to operate such infrastructure. Once the hassle of creating and maintaining such infrastructure is taken care of by the MaaS provider, it draws more customers."
An advertisement in Russian for "Raccoon" (Source: Cybereason)
International law enforcement has also taken notice of this trend. In March, Stephen Wilson, the head of the European Cybercrime Center, noted during a conference that cybercriminals are increasingly turning to these methods to monetize their efforts and cash out quickly (see: How Cybercriminals Continue to Innovate).
Recent reports by security firms Flashpoint and Armor also point to a thriving criminal underground where malware, as well as other tools, are bought and sold (see: Cybercrime Tool Prices Continue to Rise on Darknet Sites).
Russian Underground
Raccoon, which first appeared in the wild in April, appears to have originated within Russian underground forums for cybercriminals, according to the Cybereason analysis.
At first, security researchers classified it as a password stealer, but it quickly acquired many other attributes and is proficient in stealing credit card and banking data, cryptocurrency wallets, emails, data from browsers, cookies and system information , according to Cybereason. It also takes screenshots, researchers say.
Raccoon quickly spread to English-language forums. Its creators aggressively marketed its capabilities to cybercriminals and offered services, such as bullet-proof hosting and 24-hour support, Dahan says.
The Cybereason researchers also came across testimonials, usually written in Russian, touting the abilities of Raccoon. This helped Raccoon spread across the world within a few months, with Cybereason tracking attacks in North America, Europe and Asia.
A July report from Recorded Future, a threat intelligence specialist, noted spikes in Raccoon activity, along with a keylogger called Hawkeye and several newly released remote access Trojans believed to have been developed by Chinese hackers.
"We have seen targets from practically all regions of the world," Dahan says of Raccoon. "Since the majority of these attacks is of an opportunistic 'spray-and-pray' nature, we see [Raccoon] hit individuals and organizations indiscriminately."
Cybercrime , Cybercrime as-a-service , Fraud Management & Cybercrime
Here's Why 'Raccoon' Infostealer Is Popular With Criminals
Cheap and Simple 'Malware as a Service' Sold in Cybercriminal Underground
Scott Ferguson (@Ferguson_Writes) • October 25, 2019
Here's Why 'Raccoon' Infostealer Is Popular With Criminals
(Source: Nick Varvel via Flickr/CC).
The "Raccoon" infostealer, first spotted in the wild earlier this year, is rapidly gaining in popularity on underground forums due to its low cost and ability to steal a wide range of data, including credit card numbers and cryptocurrency wallets, according to a new analysis from Cybereason.
See Also: Live Webinar | Empowering Your Human Firewall: The Art and Science of Secure Behavior
What Raccoon lacks in sophistication it makes up for in ease of use, according to Cybereason. Developed on a malware-as-a-service model, cybercriminals only need access to a Tor-hosted control panel to initiate attacks using Raccoon against whatever target they pick, according to the analysis.
The infostealer sells for $175 to $200, and it's typically delivered through the Fallout or RIG exploit kits, says Assaf Dahan, senior director and head of threat research at Cybereason.
Cybercriminals have also used phishing emails with malicious Office documents that hide macros to deliver and install Raccoon on different devices. Or, they've bundled Raccoon with legitimate software , researchers say.
Demand for New Tools
"There is a big market and even bigger demand in the underground communities for new malware and new tools," Dahan tells Information Security Media Group.
"When it's bundled with good service, an 'easy to use' interface and a reasonable price, it draws the attention of a wide range of clientele. The malware-as-a-service model is quite appealing for cybercriminals who don't necessarily possess the technical skills to operate such infrastructure. Once the hassle of creating and maintaining such infrastructure is taken care of by the MaaS provider, it draws more customers."
An advertisement in Russian for "Raccoon" (Source: Cybereason)
International law enforcement has also taken notice of this trend. In March, Stephen Wilson, the head of the European Cybercrime Center, noted during a conference that cybercriminals are increasingly turning to these methods to monetize their efforts and cash out quickly (see: How Cybercriminals Continue to Innovate).
Recent reports by security firms Flashpoint and Armor also point to a thriving criminal underground where malware, as well as other tools, are bought and sold (see: Cybercrime Tool Prices Continue to Rise on Darknet Sites).
Russian Underground
Raccoon, which first appeared in the wild in April, appears to have originated within Russian underground forums for cybercriminals, according to the Cybereason analysis.
At first, security researchers classified it as a password stealer, but it quickly acquired many other attributes and is proficient in stealing credit card and banking data, cryptocurrency wallets, emails, data from browsers, cookies and system information , according to Cybereason. It also takes screenshots, researchers say.
Raccoon quickly spread to English-language forums. Its creators aggressively marketed its capabilities to cybercriminals and offered services, such as bullet-proof hosting and 24-hour support, Dahan says.
The Cybereason researchers also came across testimonials, usually written in Russian, touting the abilities of Raccoon. This helped Raccoon spread across the world within a few months, with Cybereason tracking attacks in North America, Europe and Asia.
A July report from Recorded Future, a threat intelligence specialist, noted spikes in Raccoon activity, along with a keylogger called Hawkeye and several newly released remote access Trojans believed to have been developed by Chinese hackers.
"We have seen targets from practically all regions of the world," Dahan says of Raccoon. "Since the majority of these attacks is of an opportunistic 'spray-and-pray' nature, we see [Raccoon] hit individuals and organizations indiscriminately."
3
1
