This malware prevents users from browsing pirated websites: Cybersecurity researchers

Cybersecurity researchers have found an interesting piece of malware that instead of stealing passwords or to extort a computers owner for ransom blocks infected users computers from being able to visit a large number of websites dedicated to software piracy However the malware appears murkyResearchers at Sophos a global leader in nextgeneration cybersecurity have detailed a curious cyberattack campaign that targets users of pirated software with malware designed to block access to websites hosting pirated softwareThe developers disguise the malware as cracked versions of popular online games such as Minecraft and Among Us as well as productivity tool such as Microsoft Office security software and othersThe disguised malware is distributed via the BitTorrent platform from an account hosted on ThePirateBay digital file sharing websiteAlso read Gmail blocks 100 million phishing attempts daily GoogleLinks to the malware are also hosted on Discord Once installed the malware blocks the victims access to a long list of websites including many that distribute pirated software the researchers said in a blog postThe researchers were not able to discern a provenance for this malwareBut its motivation seemed pretty clear It prevents people from visiting software piracy websites if only temporarily and sends the name of the pirated software the user was hoping to use to a website which also delivers a secondary payload they explainedAndrew Brandt principal threat researcher Sophos said Sometimes it is easy to see clearly what an adversarys end game is and why they have chosen a particular approach to achieve it This is not one of those timesOn the face of it the adversarys targets and tools suggest this could be some kind of antipiracy vigilante operationHowever the attackers vast potential target audience from gamers to business professionals make the ultimate purpose of this operation a bit murky Brandt cautionedAt least some of the malware disguised as pirated copies of a wide variety of software packages was hosted on game chat service DiscordOther copies distributed through Bittorrent were also named after popular games productivity tools and even security products accompanied by additional files that make it appear to have originated with a wellknown file sharing account on ThePirateBayIn this malware case the attackers use an ageold approach of modifying the HOSTS file settings on an infected device to localhost a long list of websites thereby blocking the users access to themThe malicious files are compiled for 64bit Windows 10 and then signed with bogus digital certificates that wouldnt pass more than a very rudimentary checkOnce downloaded and installed by a user the malware hunts for files named 7686789678967896789678 and 412412512512512 If it finds them it stops any further launch of the attack said Sophos researchersThe malware also triggers a fake error message to appear when it runs which asks people to reinstall the software they addedThis story has been sourced from a third party syndicated feed agencies Midday accepts no responsibility or liability for its dependability trustworthiness reliability and data of the text Midday managementmiddaycom reserves the sole right to alter delete or remove without notice the content in its absolute discretion for any reason whatsoever