DiamondFox, a modular botnet offered for sale on various underground forums, is an outstanding demonstration of the many advantages of this business module.
DiamondFox
DiamondFox is a modular malware-as-a-service botnet sold on underground forums and associated with the actor alias Edbitss.
Profile source: Mallory opens in a new tabDiamondFox
Family profile
DiamondFox is a modular malware-as-a-service botnet sold on underground forums and associated with the actor alias Edbitss. It is designed as a plugin-based platform that allows operators to tailor functionality per victim through a management panel that provides infection statistics and plugin control. Reported capabilities include credential theft, keylogging, cryptocurrency wallet theft, espionage-oriented collection, monetary theft, self-spreading, and distributed denial-of-service activity. DiamondFox has also been linked to removable-media and social-network propagation features, and a 2017 version reportedly included a point-of-sale plugin distinct from GlitchPOS. The malware has been marketed with ongoing updates and customer support, reflecting a commercial crimeware model aimed at a broad range of buyers, including comparatively low-skill operators. DiamondFox primarily targets Windows environments and is notable for its extensible architecture, operator panel, and use as a general-purpose criminal botnet platform.
Capabilities
- Credential Theft
- Ddos
- Exfiltration
- Keylogging
- Reconnaissance
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
DiamondFox in ATT&CK
12 distinct techniquesTechniques
12 techniques T1036 Masquerading T1568.002 Domain Generation Algorithms T1568 Dynamic Resolution T1547 Boot or Logon Autostart Execution T1547.001 Registry Run Keys / Startup Folder T1055 Process Injection T1091 Replication Through Removable Media T1566 Phishing T1555 Credentials from Password Stores T1649 Steal or Forge Authentication Certificates T1498 Network Denial of Service T1056.001 Keylogging
