PrivateLoader

New Research: How Peer2Profit and Astroproxy Turn Your Bandwidth Into Someone Else's Product - Malware News - Malware Analysis, News and Indicators

Silent Push reported that devices enrolled in PEER2PROFIT are being monetized through the commercial proxy service ASTROPROXY, effectively turning user and potentially corporate endpoints into residential proxy exit nodes. Researchers validated the link by enrolling a controlled device in PEER2PROFIT and later observing its IP address offered in ASTROPROXY’s residential pool. Because the software is typically installed with user consent and is not generally classified as malware, the activity can evade traditional enterprise security controls while exposing an organization’s IP space to abuse, fraud investigations, and reputational damage. During a 72-hour enumeration effort, the researchers identified 117,224 unique IPs across ASTROPROXY’s residential, mobile, and datacenter proxy pools, with the residential pool adding more than 1,000 new IPs per hour. The report also found that ASTROPROXY’s internal-IP filtering could be bypassed by using a DNS name that resolves to an internal address, potentially allowing proxy subscribers to reach internal resources such as router management interfaces through enrolled nodes. The findings highlight that bandwidth-sharing applications can create internal exposure and that proactive enumeration of proxy infrastructure may be more effective than reactive reputation-based blocking.

New Research: How Peer2Profit and Astroproxy Turn Your Bandwidth Into Someone Else's Product - Silent Push

Beware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and Credentials

Threat actors used fake Facebook job advertisements and impersonation content, including lures themed around Amazon CEO Andy Jassy and DocuSign, to distribute the Windows information stealer Ov3r_Stealer. Trustwave SpiderLabs found victims were redirected to Discord-hosted .url shortcut files and, in some cases, weaponized PDFs, which triggered a multi-stage infection chain involving control.exe, malicious .cpl loaders, PowerShell scripts fetched from GitHub, and a final DLL sideloading payload delivered from a remote SMB share. Once installed, Ov3r_Stealer established persistence through scheduled tasks running every 90 minutes and harvested browser credentials, crypto wallets, FTP and Discord data, documents, and system information before exfiltrating the data to attacker-controlled Telegram bots and channels. Researchers said the malware was under active development, with alternate delivery methods including HTML smuggling, SVG smuggling, and LNK masquerading, and noted strong similarities to the open-source Phemedrone Stealer; the activity was linked to aliases including Liu Kong, John Macollan, MR Meta, and MeoBlackA, with indications the operator may be offering the malware as a service.

Tofsee Botnet: Proxying and Mining | Bitsight

Researchers reported that the long-running Tofsee botnet, historically known as a modular spambot, was being distributed through the PrivateLoader malware loader tied to the ruzki pay-per-install service. While earlier reporting highlighted Tofsee’s aggressive spam activity, newer observations showed the botnet using infected systems primarily for web traffic proxying and cryptocurrency mining, with only a smaller share of activity linked to spam operations. Analysis of Tofsee’s downloaded components identified active proxy and miner plugins, including HTTP(S) and SOCKS backconnect traffic and some spam-related POST requests routed through likely compromised websites. The mining module was configured to mine Masari (MSR) through fastpool.xyz, and researchers estimated the botnet had generated about 200,000 MSR. Sampled telemetry indicated a global infection footprint, with India accounting for roughly 33% of observed infections in the dataset.

How to Identify IcedID Network Traffic

Security researchers detailed a lightweight method for identifying IcedID command-and-control infrastructure without relying on full malware reverse engineering, using a distinctive self-signed TLS certificate repeatedly found on the malware’s servers. The certificate commonly carries issuer and subject values including CN=localhost, C=AU, ST=Some-State, and O=Internet Widgits Pty Ltd, allowing defenders to search internet-wide scan data for likely matches and rapidly narrow candidate hosts tied to the banking trojan. The infrastructure was then validated by reproducing IcedID’s certificate verification logic, in which the malware hashes the certificate public key with FNV-1a 32-bit and compares the result to the certificate serial number, sometimes after XOR with 0x384A2414. Using that process, researchers confirmed 52 IcedID servers and found the infrastructure commonly exposed ports 443, 80, and 22, frequently ran Debian and nginx, and was concentrated in Romania, the United States, and Germany; related reporting on IcedID and its loader activity underscores the malware’s continued use in credential theft and banking-focused intrusions.

ICEDIDs network infrastructure is alive and well - Elastic Security Labs

Exploring Recent IcedID Campaigns: Insights from Team Cymru

Melting Ice - Tracking IcedID Servers with a few simple steps - Check Point Research