Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem

Key Points:

• A large-scale malware distribution operation is impersonating legitimate open-source and freeware projects, utilizing a Traffic Distribution System (TDS) to redirect users to malicious payloads.
• The impact includes the delivery of multiple malware families such as RemusStealer and AnimateClipper, targeting security researchers and users of popular tools like Ghidra and dnSpy.
• Recommended actions include implementing strict URL filtering, educating users about verifying software sources, and employing advanced threat detection solutions to identify suspicious traffic patterns.

Technical Details: The operation leverages CloudFront-hosted JavaScript to hijack clicks on download links, redirecting users through a TDS that enforces various gating mechanisms. Malware families identified include RemusStealer (infostealer) and AnimateClipper (crypto clipper).

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1566 - Phishing (Initial Access)
• T1204.002 - User Execution: Malicious File (Execution)

IOCs Mentioned:

• Domains: ghidralite[.]com, dnspy[.]org, remusstealer[.]com
• Malware samples associated with SessionGate, RemusStealer, and AnimateClipper.

This summary highlights the critical aspects of the malware distribution ecosystem for quick reference by security analysts.