Bitdefender identifies malware and criminal network for online ad fraud
Bitdefender has discovered a new piece of malware and a criminal network that specializes in ad fraud and has gone undetected for years.
Bitdefender, a manufacturer of antivirus program packages, has discovered a malware designed for advertising fraud that has been active since 2012. The malware, dubbed "Zacinlo" by Bitdefender, is a rootkit-based adware built on a configurable and highly modular design that can extend its functionality at any time via scripts and configuration files. A PC infected with Zacinlo either opens invisible browser instances in order to load advertising banners and simulate clicks on them, or it exchanges the ads loaded in the browser with the attacker's ads so that the fraudsters collect advertising revenue in the background.
Zacinlo is operated by the user himself via a free and anonymous VPN service called s5Mark installed. The software s5Mark has a simple graphical interface that serves as a legitimate-looking front for the undesirable behavior behind the scenes. Once installed, less tech-savvy users are fooled into thinking they are using a VPN connection, even though the software doesn't even attempt to do so. Unlike other malware, such as ransomware, Zacinlo is invisible to the user and can therefore fulfill its fraudulent purposes for a very long time, causing considerable financial damage to online advertising platforms.
The software is by no means harmless for users. The malware is rootkit-based and constantly communicates in the background with a central location that manages, configures and, if necessary, extends the software. This allows the rootkit driver to protect itself and its components from other software, in particular from being detected or restricting its criminal functionality. The malware can therefore often not be easily detected, stopped or deleted.
In addition, the malware opens the door to other possible security vulnerabilities: it can insert user-defined JavaScript code into the websites visited by the user or install almost any software on the fly, thus extending its functionality. In addition, Zacinlo can exfiltrate information from the infected computer and report it to the control center, for example about installed anti-malware solutions or autostart applications. The malware can also take screenshots and send them to the attackers' command & control servers.
To obtain advertising, Zacinlo uses multiple platforms, including Google AdSense. The malware runs on Windows operating systems and has a clear affinity for Windows 10.
Geographically, the software is active worldwide, but particularly in markets with high advertising relevance such as the USA, Germany and France. The malware can use a variety of browsers for its activities, including Edge, Internet Explorer, Firefox, Chrome, Opera and Safari.
The criminal activities with Zacinlo can be dated back to 2012. However, usage has risen sharply since the end of 2017.
Zacinlo is extremely difficult to remove due to its close integration with the operating system and, thanks to its defense mechanisms, is also not detected by common anti-malware solutions. In the event of an infection, Bitdefender recommends - unsurprisingly - a system scan in Bitdefender Rescue Mode to remove the rootkit and all its adware components.
To help the security community stop Zacinlo and the cybercriminals behind the malware, Bitdefender has analyzed the malware and its processes in detail. The full report is available free of charge at this link available.
