Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked.
Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Cyberattack targets French blood banks
November 4, 2026
A cyberattack on several French blood banks sought to raise temperatures to extremely high levels but was thwarted before it could do any damage to blood products or samples, authorities said. The incident comes after supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were ...
- DOJ warns FBI data breach likely extends to Justice Department employees
November 4, 2026
A major data breach of FBI systems likely also affected staffers across the Justice Department, according to a memo obtained by POLITICO. FBI investigators determined in September that a hack of a bureau jobs portal was a “major” cyber incident, allowing hackers to steal personal information on thousands of FBI agents, including Social Security numbers, birth ...
- The most used lateral movement hacking tools across enterprise infrastructures
November 2, 2026
The statistics compiled from detection alerts* within Kaspersky Anti Targeted Attack (KATA) reveal the hacking tools most often used for lateral movement across enterprise infrastructures, highlighting the pressing need for reliable network security solutions to protect corporate environments. Recent investigations into cyber-espionage groups show that attackers increasingly avoid detectable malware, choosing instead to blend into legitimate ...
- Germany says lawmakers’ iPhones may have been hacked with spyware
November 2, 2026
The German government is warning politicians and public figures that they were targeted by government-backed spyware, days after Apple began sending out notifications warning victims that their iPhones may have been hacked. Germany’s federal cybersecurity office, known as the BSI, said in a note over the weekend that it had become aware that members of the ...
- AI-driven attacks on educational organizations in Latin America and Africa
November 2, 2026
Kaspersky Threat Research has uncovered attacks on educational organizations in Latin America and Africa in which attackers used artificial intelligence to help direct activity inside compromised networks. Researchers traced reconnaissance, credential theft, movement between computers and data collection, including activity that compromised highly privileged administrator accounts. The attackers used CyberStrikeAI, an open-source penetration-testing framework that combines ...
- Inside the underground fake review trade
November 2, 2026
Recently, our team exposed sophisticated scam kits designed to steal sensitive data and trick consumers. But underground marketplaces are not just for malware and stolen passwords. They also offer services designed to manipulate your opinion of the products and services you buy every day. In our latest research, we examined cybercrime forums where sellers advertise illicit ...