Crimeware server catering to “grab and run” criminals

During our research for the latest Malicious Page of the Month that has just been released, we came across a domain that was being used as a command and control for the Crimeware that was executed on attacked machines. This domain was also used as the “drop site” for private information being harvested by that Crimeware.
When we further examined this server, we found that the stolen data on it was unprotected and freely accessible to anyone – we found no access restrictions, no encryption whatsoever!
In total, we found more than 1.4Gb of personal and business data (including emails and web related data) for grabs, collected from infected PCs.

Obviously, no business or personal data was safe; we found logs with business information on shipments, intellectual property, pension funds, legal cases, patients, marketing strategies etc. but also personal information that criminal elements could use to their own benefit.

Following are some of the records that were on that server for grabs.
We changed/blurred information to protect people’s and companies’ privacy.

Medical record:

Email communications:

Outlook with email communications:

Bank customer’s credit card details:

We were especially curious how these user data for grabs were managed by the cybercriminals, and we found a C&C application that they used for that purpose.
The administration of this Command & Control (C&C) function consists of a PHP based web application. It managed the infected machines, and enabled the criminal to address specific groups of “users” –by country, by IP, by type of logs, you name it!

The administrator could also issue commands, instructing the Crimeware on the infected machines to perform certain actions:

The server we investigated hosted multiple “attack campaigns”.
Each campaign had its own logged data from the infected users, as well as an administrative interface to the attack Crimeware toolkit that was used to infect the users (in this case the “AdPack” toolkit).

The administrative (statistics) interface to these AdPack toolkits showed how effective each campaign was, and provided statistical information on the geographical location of the infections, and of course, referral statistics to accurately measure where did the infections come from.

With user data services as described above, we now see that Crimeware has reached a new level of sophistication – again!
We see that Command & Control applications enable administrators to manage the actions and performance of their Crimeware. It gives them also control over the users of the Crimeware as well as its victims. Most scarily of all – it also allows easy access to user data.
The full research is captured in our MPOM April 2008.
We would like to emphasize, that due to restrictions set by law, the research discloses only a fraction of the amount and type of data that we found on the crime server.