Researchers Uncover Lucrative ‘Stantinko’ Adware Campaign

Security researchers have discovered a large-scale adware campaign that has been operating since 2012 and affected nearly half a million users.

According to researchers at ESET Security, the sophisticated Stantinko campaign primarily targets Russia and Ukraine and has utilised a combination of code encryption and rapid adaptation techniques to stay out of sight of anti-malware tools.

Once installed, Stantinko generates revenue for its operators in several different ways, including through ad injection and click fraud.

Adware threat

“To infect a system, they trick users looking for pirated software into downloading executable files sometimes disguised as torrents,” explain Frederic Vachon and Matthieu Faou on the Eset blog. “FileTour, Stantinko’s initial installation vector, then loudly installs a lot of software to distract the user while it covertly installs Stantinko’s first service in the background.”

Once installed, it avoids detection by concealing the malicious code inside an encrypted component that resides either on the disk or in the Windows registry. This makes it hard for anti-malware tools to detect the infection as malicious behaviours remain hidden.

Stantinko is also highly resilient, as is installs two malicious Windows services that each have the ability to reinstall the other, meaning both services need to be deleted at the same time in order to fully remove it from the system.

Its main role is to install malicious browser extensions called The Safe Surfing and Teddy Protection, as the researchers explain: “Both extensions were available on the Chrome Web Store during our analysis. At first sight, they look like legitimate browser extensions that block unwanted URLs.

“However, when installed by Stantinko, the extensions receive a different configuration containing rules to perform click fraud and ad injection.” This generates revenue for the operators as they are paid for the traffic they provide to advertisers.

But it doesn’t stop there: “The malicious Windows services they install enable them to execute anything on the infected host.

“We’ve seen them being used to send a fully featured backdoor, a bot performing massive searches on Google, and a tool performing brute-force attacks on Joomla and WordPress administrator panels in an attempt to compromise and potentially resell them.”

Although not noticeable to the user, Stantinko is certainly a major threat, providing a large source of income for its creators and putting user’s privacy at risk.

Quiz. Are you a security guru?

Sam Pudwell

Sam Pudwell joined Silicon UK as a reporter in December 2016. As well as being the resident Cloud aficionado, he covers areas such as cyber security, government IT and sports technology, with the aim of going to as many events as possible.

Recent Posts

Apple Security Flaw Being Actively Exploited

Update now. Vulnerability impacts a number of Apple iPhone, iPad and Mac models, and the…

13 hours ago

Yale University Names Firms Still Operating In Russia

Data from Yale University shows a number of big name tech companies continue to trade…

13 hours ago

Police Arrest Four Over BT Cable Theft In North Yorkshire

Police make arrests after Openreach confirms to Silicon UK that a cable theft left 200…

1 day ago

UK Staff Resisting ‘Big Return’ To The Office, Says infinitSpace

Remote working to stay? Majority of business leaders are struggling to get staff to return…

1 day ago

Apple Axes 100 Recruiters, Amid Hiring Slowdown – Report

Hiring slowdown at Apple? Tech giant reportedly lets go 100 contract-based recruiters in the past…

1 day ago