Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked.
Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Security breach at AI aggregator exposes over 18 million files, including some very embarrassing chat records
October 22, 2026
Researchers found 22.7TB of exposed data from AI aggregator 302.ai, including chat logs and personal information. Leaked records contained user prompts, AI responses, metadata, and sensitive corporate documents. Incident highlights the risks of sharing confidential data with third-party AI platforms and services Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news ...
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
October 22, 2026
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no ...
- Government websites in Europe and elsewhere go dark as software flaw sparks security scramble
October 21, 2026
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems. Developers of the PHP programming language said Tuesday they had identified two critical vulnerabilities and urged users to update their sites as soon as a fix ...
- Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline
October 19, 2026
Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” ...
- Florida DMV hacked after police dept insecurely stored login info
October 19, 2026
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has begun notifying victims impacted by a recent data breach of driver’s license and motor vehicle data, but not everyone whose information was stolen will receive an alert. In a notice posted Friday, FLHSMV confirmed that it took “immediate steps” after discovering that “a malicious actor ...
- Millions of California students’ sensitive data stolen in breach
October 19, 2026
Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and families after an unauthorized ...