Hackers Use NullMixer and SEO to Spread Malware More Efficiently

Security scientists from Kaspersky have spotted a new series of campaigns concentrating on the malware tool they named NullMixer.

In accordance to an advisory posted by the business earlier today, NullMixer spreads malware through destructive internet sites that can be simply observed by way of well-liked search engines, including Google.

“These internet websites are normally connected to crack, keygen and activators for downloading application illegally, and when they may faux to be legit software program, they in fact consist of a malware dropper,” reads the advisory.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The scientists more described that when end users attempt to obtain software from 1 of these web-sites, they are redirected various instances and inevitably land on a page made up of obtain recommendations along with an archived password–protected malware performing as the desired software device. 

When a person extracts and executes NullMixer, nonetheless, the destructive software drops a number of malware documents to the compromised machine. 

“These malware people may incorporate backdoors, bankers, credential stealers and so on,” Kaspersky wrote. “For instance, the adhering to people are amid individuals dropped by NullMixer: SmokeLoader/Smoke, LgoogLoader, Disbuk, RedLine, Fabookie, ColdStealer.”

At the time of creating, the security researchers explained in 2022 by itself, they’ve blocked makes an attempt to infect more than 47,778 victims around the world, found largely throughout Brazil, India, Russia, Italy, Germany, France, Egypt, Turkey and the United States.

Kaspersky also clarified that they are at this time unable to attribute NullMixer to any precise team or menace actor.

A lot more normally, the cybersecurity firm warned people in opposition to attempting to save revenue by applying unlicensed application.

“A single file downloaded from an unreliable supply can direct to a large–scale an infection of a laptop or computer process,” the firm wrote.

Multiple malware families dropped by NullMixer are categorized by the enterprise and the normal security neighborhood as Trojan–Downloaders. This indicates bacterial infections may well not be limited to the malware family members described in the report. 

“Many of the other malware people described here are stealers, and compromised qualifications can be applied for more attacks inside a regional network.”

The report will come weeks immediately after the FBI warned from cyber–criminals ever more hijacking house IP addresses to disguise credential–stuffing exercise and enhance their prospects of success.