{"id":6148,"date":"2012-02-27T20:30:18","date_gmt":"2012-02-28T03:30:18","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=6148"},"modified":"2018-01-30T12:25:39","modified_gmt":"2018-01-30T19:25:39","slug":"how-cybercriminals-monetize-malware-infected-hosts","status":"publish","type":"post","link":"https://www.webroot.com/blog/2012\/02\/27\/how-cybercriminals-monetize-malware-infected-hosts\/","title":{"rendered":"How cybercriminals monetize malware-infected hosts"},"content":{"rendered":"<p>The vibrant cybercrime underground ecosystem offers countless ways to monetize the malware-infected hosts at the disposal of the malicious attacker.<\/p>\n<p><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-6166\" title=\"Facebook_Twitter_YouTube_followers_likes_views\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views.png\" alt=\"\" width=\"464\" height=\"56\" \/><\/a><\/p>\n<p>From converting them to <strong><a href=\"http:\/\/ddanchev.blogspot.com\/2008\/10\/cost-of-anonymizing-cybercriminals.html\">anonymization proxies<\/a><\/strong> assisting <strong><a href=\"http:\/\/ddanchev.blogspot.com\/2009\/02\/cost-of-anonymizing-cybercriminals.html\">cybercriminals in covering their Web activities<\/a><\/strong>, to launching DDoS attacks, and using them to disseminate spam and more malicious threats, cybercriminals have a vast arsenal of monetization tactics in their arsenal.<\/p>\n<p>In this post we&#8217;ll profile a recently advertised service offering thousands of Facebook &#8220;Likes&#8221;, Twitter followers, and YouTube views, all for the modest price of a couple of hundred rubles, entirely relying on malware-infected hosts for supporting their infrastructure.<\/p>\n<p><!--more--><\/p>\n<p>Basically, the service is abusing the trusted reputation of malware-infected Facebook, Twitter and YouTube users for the purpose of superficially increasing the popularity of a particular item located within these sites\/social networking platforms.<\/p>\n<p>Every malware-infected user counts as a separate &#8220;Like&#8221;, Twitter follower, or video viewer at YouTube, all of them unknowingly participating in these illegal marketing campaigns.<\/p>\n<p>And what about the prices? The prices vary based on the number of requested marketing operations to be performed on behalf of the malware-infected hosts participating in the campaign, also known as bots.<\/p>\n<p>Sample prices for Facebook marketing campaigns:<\/p>\n<blockquote><p>Facebook Likes (I like) boots<br \/>\n1000 Likes Facebook &#8211; 300 rubles<br \/>\nFacebook Likes (I like it) Russian<br \/>\n1000 Likes Facebook &#8211; 3,000 rubles<br \/>\nFacebook Likes (I like) all over the world<br \/>\nin 1000 Likes Facebook &#8211; 2,500 rubles<br \/>\nFacebook Likes (I like), RF<br \/>\n1000 Likes Facebook &#8211; 7000<\/p><\/blockquote>\n<p><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views_01.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-6168\" title=\"Facebook_Twitter_YouTube_followers_likes_views_01\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views_01.png\" alt=\"\" width=\"303\" height=\"258\" \/><\/a><\/p>\n<p>Sample prices for YouTube marketing campaigns:<\/p>\n<blockquote><p>Views: All views 100% live<br \/>\naction: 100 000 hits &#8211; only 25 000 rub<br \/>\n1000 views &#8211; 400rub (speed of 50 000 &#8211; 100 000 hits a day .)<br \/>\nviews at 1000 hits per day &#8211; 1,500 rubles for 5000<br \/>\nCheat Rating (Likes)<br \/>\n100 Likes &#8211; 300 rubles<br \/>\nFavorites Subscribers:<br \/>\n100 &#8211; 300 rub<br \/>\nYour video on the home page of YouTube (Once on the main Youtube.Com your movie will surely be seen !)<br \/>\nPrice is negotiated personally with me. Ready to offer an adequate price.<\/p><\/blockquote>\n<p style=\"text-align:center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views_02.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter  wp-image-6169\" title=\"Facebook_Twitter_YouTube_followers_likes_views_02\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views_02.png\" alt=\"\" width=\"473\" height=\"214\" \/><\/a><\/p>\n<p>Sample prices for Twitter marketing campaigns:<\/p>\n<blockquote><p>2,500 followers &#8211; 700 rubles (1 day)<br \/>\n5000 followers &#8211; 1400 rubles ( 2-3 days)<br \/>\n10 000 followers &#8211; 2600 rubles (4-5 days)<br \/>\n25 000 followers &#8211; \u00a3 5500 (9-12 days )<br \/>\n50 000 followers &#8211; 10 000 rubles (17-25 days)<\/p><\/blockquote>\n<p><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views_03.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-6170\" title=\"Facebook_Twitter_YouTube_followers_likes_views_03\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/facebook_twitter_youtube_followers_likes_views_03.png\" alt=\"\" width=\"364\" height=\"192\" \/><\/a><\/p>\n<p>Webroot&#8217;s security researchers will continue monitoring the service and its future development.<\/p>\n<p><em>You can find more about Dancho Danchev at his\u00a0<strong><a href=\"http:\/\/nl.linkedin.com\/in\/danchodanchev\">LinkedIn Profile<\/a><\/strong>. You can also\u00a0<strong><a href=\"http:\/\/www.twitter.com\/danchodanchev\">follow him on \u00a0Twitter<\/a><\/strong>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The vibrant cybercrime underground ecosystem offers countless ways to monetize the malware-infected hosts at the disposal of the malicious attacker. From converting them to anonymization proxies assisting cybercriminals in covering their Web activities, to launching DDoS attacks, and using them to disseminate spam and more malicious threats, cybercriminals have a vast arsenal of monetization tactics [&hellip;]<\/p>\n","protected":false},"author":65,"featured_media":17051,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[9901,9881,9911,9909,9885,9893,9877,9875,9907,4497,9897,9891,9883,9905,9895,9879,9887,9889,9903,9899],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/6148"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=6148"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/6148\/revisions"}],"predecessor-version":[{"id":19071,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/6148\/revisions\/19071"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17051"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=6148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=6148"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=6148"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=6148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}