Fake Software Cracks: A Shady Work of Threat Actors

Why?

• Usually, pirated software are used by threat actors to distribute a variety of malware. 
• These types of software are distributed via shady sites, YouTube, and torrents to trick victims into believing that they are downloading the latest software or a game installer. 

A thriving channel for cybercrime

• With many users still turning to bootleg and pirated copies of software, it has increased the chances for threat actors expanding their attack scope.
• Earlier this year, Microsoft announced Windows 11 and while there is no official software launch yet, bad actors have created several fake versions of the OS downloaders that ultimately drop the malware.
• In a different incident, Bitdefender decoded a new malware loader named MosaicLoader that leveraged cracked software as part of its infection chain process.
• A new Monero mining malware identified as Crackonash also made its way into victims’ systems via pirated versions of NBA 2K19, Pro Evolution Soccer 2018, and Grand Theft Auto V.
• In an interesting attempt, a student attempted to pirate an expensive data visualization software that finally resulted in a full-blown Ryuk ransomware attack at a European biomolecular research institute.

An interesting case of vigilante malware

• Sophos researchers recently discovered a new malware that blocked users from visiting pirated sites such as ThePirateBay.
• Named as ‘OddBall’, the malware is quite unique and prevents pirated websites that can contain files to steal passwords and other sensitive details. 
• It was discovered that the malware delivered a secondary payload, an executable named ProcessHacker.jpg, that performs various functions on a system.   

The bottom line