Strokovnjaki odkrili neznano zlonamerno programsko opremo, ki je ukradla 1.2 TB zaupnih podatkov
NordLocker experts has discovered an impressive database of information collected by unknown custom malware from more than 3 million Windows-based computers.
The 1.2 TB database contained 6.6 million files, 26 million credentials, in 2 billion authorization cookies, z 400 million of them valid at the time the database was discovered.Researchers were unable to identify the malware through which the information was collected, but it is known that it spread from 2018 to 2020 through malicious versions of Adobe Photoshop, pirated games and Windows hacking tools.
The credentials contained in the database included 1.1 million unique email addresses used as logins for various applications and services, including social networks, job search sites, online stores, financial services, itd.
Poleg tega, the database contained credentials, as well as information from autocomplete fields and payment data stolen from 48 applications, mainly browsers and email clients, such as Google Chrome (19.4 million entries), Mozilla FireFox (3.3 million entries ), Opera (2 million entries) Internet Explorer/Microsoft Edge (1.3 million entries), Chromium (1 million entries), CocCoc (451,962 entries), Outlook (111,732 entries), Yandex (79,530 entries), Torch ( 57,427 million records), Thunderbird (42,057 million records).
Among other things, experts found in the database a total of 6 million files stolen by malware from the download folders and the desktop. The information included 3 million text files, over 1 million images, and over 600,000 Microsoft Word and PDF documents.
The database also contained a huge number of stolen cookies for e-commerce sites, gaming sites, file hosting services, video streaming services, social media, as well as cookies used for user tracking and targeted advertising.
Experts believe that the owners of the base accidentally revealed its location. NordLocker has already notified the cloud hosting provider of its finding.
Details about malware:
- This is a Trojan-type malware that was transmitted via email and illegal software. The software includes illegal Adobe Photoshop 2018, a Windows cracking tool, and several cracked games.
- The data was collected from 3.25 million computers. The malware stole nearly 26 million login credentials holding 1.1 million unique email addresses, 2 billion+ cookies, in 6.6 million files.
- Nameless, or custom, trojans such as this are widely available online for as little as $100. Their low profile often helps these viruses stay undetected and their creators unpunished.
- Screenshots made by the malware reveal that the data was stolen between 2018 in 2020.
- The virus assigned unique device IDs to the stolen data, so it can be sorted by the source device.
Let me remind you that I talked about that MountLocker ransomware uses Windows API to navigate the network.
