Avalanche

Also known as: Avalanche
(US-CERT) Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers. In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise. Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies. Avalanche has been observed to distribute GozNym (operated by Bamboo Spider, TA544 used-by and much of the malware from ‘TA505, Graceful Spider, Gold Evergreen’.
🌍 Country ["Russia"]

Associated Operations

2010-05 Worst Phishing Pest May be Revving Up https://www.pcworld.com/article/196304/worst_phishing_pest_may_be_revving_up.html

Introduction

(US-CERT) Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers. In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise. Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies. Avalanche has been observed to distribute GozNym (operated by Bamboo Spider, TA544|used-by and much of the malware from ‘TA505, Graceful Spider, Gold Evergreen’.

Activities and Tactics

Country of Origin: 🇷🇺 [“Russia”]

Notable Campaigns

  • 2010-05
  • Worst Phishing Pest May be Revving Up
  • https://www.pcworld.com/article/196304/worst_phishing_pest_may_be_revving_up.html

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Avalanche
  • Avalanche:

Attribution and Evidence

Country of Origin: [“Russia”] Additional attribution information pending cataloguing.

References

References pending cataloguing.