Sprawling Sathurbot Takes Aim at WordPress, Movie Pirates

Movie piracy is alive and well– as are the bad stars that seek to victimize the pirates.ESET has actually uncovered a brand-new environment for the Sathurbot backdoor Trojan, consisting of more than 20,000 infected computer systems. This version has been active given that at least June 2016, and is mainly using illegal torrents as a delivery medium, especially pirated movie downloads. It’s also brute-forcing weak WordPress administrator passwords to aid in its distribution efforts.”It just might occur that your favorite search engine

returns connect to gushes on websites that typically have nothing to do with file sharing,”discussed the researchers, in an analysis.”They might, however, run WordPress and have actually simply been compromised. “ESET found that the film-lure subpages all lead to the very same torrent file; and,

there are a number of pages for fake software downloads that become part of the campaign that result in another file. In both cases, the criminals have actually taken actions to be sneaky and not tip off the target. “When you start torrenting in your preferred torrent client, you will find the file is well-seeded and thus appears genuine,” the scientists said.”If you download the movie torrent, its material will be a file with a video extension accompanied by an apparent codec pack installer, and an explanatory text file. The software application torrent contains an obvious installer executable and a small text file. The objective of both is to attract [get] the victim to run the executable which loads the Sathurbot DLL.” If the target begins the executable, his or her device ends up being a bot in the Sathurbot network. From there, Sathurbot can update itself, and download and start other executables for malware, consisting of Boaxxe, Kovter and Fleercivet. Mainly it commences compromising more websites in a proliferation effort.ESET found that Sathurbot for now is primarily harvesting domain that have WordPress sites; but it’s likewise interested in Drupal, Joomla, PHP-NUKE, phpFox and DedeCMS. Once it’s recognized suitable websites, it probes for domain gain access to qualifications(formatted as login:password@domain ).”Different bots in Sathurbot’s botnet attempt various login qualifications for the exact same site,” the researchers explained.” Every bot just tries a single

login per site and carry on. This style helps ensure that the bot doesn’t get its IP address blacklisted from any targeted website and can review it in the future.”The idea of course is to compromise as numerous sites– and for that reason end users– as possible, creating a large botnet that’s primed and prepared to provide whatever destructive payload that for-hire clients would like.ESET recommends that web admins examine for unidentified subpages and/or directories on their servers; if they contain any references to torrent download offers, examine logs for attacks and possible backdoors. They should change passwords, eliminate subpages not coming from site, and additionally clean and restore the site from a backup.


Written by 

Related posts