{"id":11301,"date":"2013-06-04T00:00:24","date_gmt":"2013-06-04T07:00:24","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=11301"},"modified":"2018-01-30T12:31:53","modified_gmt":"2018-01-30T19:31:53","slug":"new-e-shop-sells-access-to-thousands-of-hacked-pcs-accepts-bitcoin","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/06\/04\/new-e-shop-sells-access-to-thousands-of-hacked-pcs-accepts-bitcoin\/","title":{"rendered":"New E-shop sells access to thousands of hacked PCs, accepts Bitcoin"},"content":{"rendered":"<p>Remember the <a href=\"http:\/\/blog.webroot.com\/2013\/05\/13\/newly-launched-e-shop-for-hacked-pcs-charges-based-on-malware-executions\/\"><strong>E-shop offering access to hacked PCs<\/strong><\/a>, based on malware &#8216;executions&#8217; that we profiled last month?<\/p>\n<p>We have recently spotted a newly launched, competing E-shop, once again selling access to hacked PCs worldwide, based on malware &#8216;executions&#8217;. However, this time, there&#8217;s no limit to the use of (competing) bot killers, meaning that the botnet master behind the service has a higher probability of achieving market efficiency compared to\u00a0their &#8220;colleague.&#8221;\u00a0Additionally, the botnet master\u00a0won&#8217;t have to manually verify the presence of bot killers and will basically aim to sell access to as many hacked PCs as possible.<\/p>\n<p>More details:<\/p>\n<p><!--more--><\/p>\n<p><strong>Sample screenshot of the actual advertisement:<\/strong><\/p>\n<p style=\"text-align:center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2013\/06\/e-shop_hacked_compromised_pcs_hosts_malware.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter  wp-image-11307\" alt=\"E-Shop_Hacked_Compromised_PCs_Hosts_Malware\" src=\"http:\/\/webrootblog.files.wordpress.com\/2013\/06\/e-shop_hacked_compromised_pcs_hosts_malware.png\" width=\"540\" height=\"494\" \/><\/a><\/p>\n<p>The newly launched E-shop not only accepts Bitcoin but guarantees up to 20,000 hacked PCs on a daily basis; given that someone&#8217;s interested in purchasing access to this many hosts. 1,000 hosts go for $30, 10,000 hosts go for $250, and 20,000 hosts go for $400, all of them from mixed international locations, meaning\u00a0they&#8217;re infecting virtually anyone\u00a0that\u00a0can be\u00a0infected without bothering to segment the &#8216;targeted population&#8217; in any of the campaigns that are responsible for generating\u00a0their &#8216;inventory&#8217;.<\/p>\n<p><strong>Sample screenshot of a customer confirming the legitimacy of the service:<\/strong><\/p>\n<p style=\"text-align:center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2013\/06\/e-shop_hacked_compromised_pcs_hosts_malware_011.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter  wp-image-11315\" alt=\"E-Shop_Hacked_Compromised_PCs_Hosts_Malware_01\" src=\"http:\/\/webrootblog.files.wordpress.com\/2013\/06\/e-shop_hacked_compromised_pcs_hosts_malware_011.png\" width=\"480\" height=\"199\" \/><\/a><\/p>\n<p>We expect to continue spotting newly launched E-shops selling access to hacked PCs as a service, accepting either Bitcoin, or alternative payment methods, due to the overall availability of easy to use DIY (do-it-yourself) malware generating tools, or services allowing novice cybercriminals to <a href=\"http:\/\/blog.webroot.com\/2013\/02\/22\/diy-malware-cryptor-as-a-web-service-spotted-in-the-wild\/\"><strong>generate a completely undetected<\/strong><\/a> &#8212; using <a href=\"http:\/\/blog.webroot.com\/2012\/02\/23\/why-relying-on-antivirus-signatures-is-simply-not-enough-anymore\/\"><strong>signatures-based scanning<\/strong><\/a> techniques &#8212; pieces of <a href=\"http:\/\/blog.webroot.com\/2013\/05\/20\/diy-malware-cryptor-as-a-web-service-spotted-in-the-wild-part-two\/\"><strong>malicious software<\/strong><\/a>.<\/p>\n<p><em>You can find more about Dancho\u00a0Danchev at his\u00a0<strong><a href=\"http:\/\/linkedin.com\/in\/danchodanchev\">LinkedIn Profile<\/a><\/strong>.\u00a0<\/em><em>Y<\/em><em>ou can also\u00a0<strong><a href=\"http:\/\/www.twitter.com\/danchodanchev\">follow him on Twitter<\/a><\/strong>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Remember the E-shop offering access to hacked PCs, based on malware &#8216;executions&#8217; that we profiled last month? We have recently spotted a newly launched, competing E-shop, once again selling access to hacked PCs worldwide, based on malware &#8216;executions&#8217;. However, this time, there&#8217;s no limit to the use of (competing) bot killers, meaning that the botnet [&hellip;]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[3485,14891,3959,5541,14883,14889,9345,5561,3677,10607,3877,3477,14887,14885,4323,5605,5551,5533,14881,3471],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/11301"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=11301"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/11301\/revisions"}],"predecessor-version":[{"id":23780,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/11301\/revisions\/23780"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=11301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=11301"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=11301"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=11301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}