Watching Commodity Malware Get Sold to a Targeted Actor
summary
Research analyzes how mass-click-fraud/adware compromises are re-classified, upgraded and sold on marketplaces where sellers verify live access before listing. Commodity infections pivot within 5 days using PowerShell, DGA C2s and RDP shells, then escalate privileges, inject into msdtc and sell assets for anything from $3 to $8,000 (examples: $13 for an Intel-hosted server). Market listings number ~15,000 US / 40,000 worldwide and flip in 2–3 hours. Defensible indicators: RDP-based C2, sudden C2 behavior change, long-lived sessions, privilege escalation and unfamiliar browser/software footprints.
AI-written summary · about
chapters (7)
- 0:00Introduction and logistics
- 1:03Marketplaces for compromise
- 3:54The economics of black markets
- 7:49Marketplace operations
- 15:58Case study of attack escalation
- 21:57Detection and hunting rules
- 26:01Q&A and closing
related talks
54mModern Malvertising and Malware web-based exploit campaigns
55mModern Malvertising ...
49mThe State Of Malware From The Eye Of The Tiger
52mRansomware 101: Get Smart Understanding Real Attacks
44mWhen you can't afford 0days: Client-side exploitation for the masses
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
12mThe anatomy of a malware attack: Past, present and future
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them