Recently, our team exposed sophisticated scam kits designed to steal sensitive data and trick consumers. But underground marketplaces are not just for malware and stolen passwords. They also offer services designed to manipulate your opinion of the products and services you buy every day.
In our latest research, we examined cybercrime forums where sellers advertise illicit “reputation management” services. For the right price, these underground operators offer to flood a product with glowing, five-star ratings or remove negative reviews. This shadowy industry works both ways—artificially boosting reputations and deliberately hiding legitimate complaints.
A major shift we are seeing in this space is the adoption of new technology. We also found that cybercriminals are using AI to automate these fake review campaigns. This could allow them to quickly generate realistic, human-sounding feedback in large volumes without much manual effort.
Read more…
Source: Malwarebytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Hackers are exploiting Fortinet firewall bugs to plant ransomware
March 17, 2025
Security researchers have observed hackers linked to the notorious LockBit gang exploiting a pair of Fortinet firewall vulnerabilities to deploy ransomware on several company networks. In a report published last week, security researchers at Forescout Research said a group it’s tracking dubbed “Mora_001” is exploiting the Fortinet firewalls, which sit on the edge of a company’s ...
- Infamous ransomware hackers reveal new tool to brute-force VPNs
March 17, 2025
The “BRUTED” tool has apparently been in use for years now, according to cybersecurity researchers EclecticIQ, who have been sifting through the recently-leaked Black Basta chat logs, which were leaked and subsequently uploaded to a GPT for easier analysis. Besides being used to analyze the group’s structure, organization, and activities, researchers used it to identify the ...
- Ascom affected by cyber attack
March 17, 2025
On 16 March 2025, a cyber-attack compromised Ascom’s technical ticketing system. Other IT systems and customer systems remain unaffected, and our business is fully operational as usual. Investigations against such criminal offenses were initiated immediately and are ongoing. Ascom is working closely with the relevant authorities. A group calling itself the “Hellcat ransomware gang” announced on ...
- StilachiRAT analysis: From system reconnaissance to cryptocurrency theft
March 17, 2025
In November 2024, Microsoft Incident Response researchers uncovered a novel remote access trojan (RAT) they named StilachiRAT that demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data. Analysis of the StilachiRAT’s WWStartupCtrl64.dll module that contains the RAT capabilities revealed the use of various methods to steal information from the target ...
- Head Mare and Twelve join forces to attack Russian entities
March 13, 2025
In September 2024, a series of attacks targeted Russian companies, revealing indicators of compromise and tactics associated with two hacktivist groups: Head Mare and Twelve. kaspersky investigation showed that Head Mare relied heavily on tools previously associated with Twelve. Additionally, Head Mare attacks utilized command-and-control (C2) servers exclusively linked to Twelve prior to these incidents. This ...
- #StopRansomware: Medusa Ransomware
March 12, 2025
Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021. As of February 2025, Medusa developers and affiliates have impacted over 300 victims from a variety of critical infrastructure sectors with affected industries including medical, education, legal, insurance, technology, and manufacturing. The Medusa ransomware variant is unrelated to the MedusaLocker variant and the Medusa mobile ...