Loading malware…
Glupteba is a modular Windows-focused criminal botnet and malware platform active since at least 2011. Its core component operates as a dropper and backdoor, downloading additional modules for proxying, cryptocurrency mining, browser-data theft, network scanning, router compromise, and other monetization activities. It has been distributed through pay-per-install ecosystems, malicious or pirated-software installers, exploit kits, and malvertising campaigns. Glupteba establishes persistence through autorun mechanisms and scheduled tasks, attempts UAC bypass and SYSTEM-level execution, and deploys kernel drivers to conceal files and processes and interfere with security tooling. It can add Microsoft Defender exclusions and firewall rules, collect host information, receive remote commands, download and execute payloads, capture screenshots, upload files, and manage mining components. Glupteba has spread laterally through EternalBlue exploitation and incorporates scanning and SSH brute-force functionality. Some variants steal browser credentials, cookies, browsing history, and other profile data, while router-focused components target vulnerable MikroTik RouterOS devices, configure compromised routers as SOCKS proxies, and use them to relay malicious traffic. A distinctive resilience feature is its use of Bitcoin blockchain transaction data, including OP_RETURN fields, to recover updated command-and-control infrastructure after conventional takedowns. The botnet has been associated with large-scale credential theft, cryptojacking, residential proxy operations, advertising abuse, and the compromise of network devices used in the Mēris DDoS botnet. A 2021 U.S. civil complaint alleged that Russian cybercriminals operated the Glupteba enterprise and infected more than one million devices worldwide.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
We recently caught a malvertising attack distributing the malware Glupteba... After looking into the recent variant of the Glupteba dropper delivered from the malvertising attack, we found that the dropper downloaded two undocumented components aside from the Glupteba malware...
Glupteba malware was first seen in the year 2014... Basically Glupteba malware are Remote Access (Backdoor) Trojans, capable of spreading using EternalBlue exploits.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In our report, we’ve taken a deep dive into what makes the Glupteba malware distinctive. The core malware is, in essence, a dropper with extensive backdoor functionality...
UNCOVERING A BROAD CRIMINAL ECOSYSTEM POWERED BY ONE OF THE LARGEST BOTNETS, GLUPTEBA
Glupteba malware was first seen in the year 2014... Basically Glupteba malware are Remote Access (Backdoor) Trojans, capable of spreading using EternalBlue exploits.
Il dépose entre 40 et 50 exécutables ... et installe simultanément plusieurs familles de malwares : Glupteba (botnet/backdoor avec rootkit)
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Once credentials are successfully obtained, a task is added to the scheduler of the router... The router exploiter component scheduled a task named “U6” on compromised routers for command and control.
Once credentials are successfully obtained, a task is added to the scheduler of the router... The router exploiter component scheduled a task named “U6” on compromised routers for command and control.
...были найдены определенно подозрительные задачи... Вторая с использованием легитимной программы certutil.exe и переданного параметра urlcache загружает... app.exe ... после чего обеспечивает его запуск.
It allows the attackers to grab the administrator’s credentials from unpatched routers.
Once credentials are successfully obtained, a task is added to the scheduler of the router... The router exploiter component scheduled a task named “U6” on compromised routers for command and control.
...были найдены определенно подозрительные задачи... Вторая с использованием легитимной программы certutil.exe и переданного параметра urlcache загружает... app.exe ... после чего обеспечивает его запуск.
If process is not elevated, it tries to exploit the fodhelper method to get it elevated. If it is elevated but not running as a SYSTEM user, it uses the “Run as Trusted Installer” method, likely inspired by this code, which uses a stolen winlogon process token to run process as SYSTEM.
It allows the attackers to grab the administrator’s credentials from unpatched routers.
it uses the “Run as Trusted Installer” method... which uses a stolen winlogon process token to run process as SYSTEM
The main dropper binary has embedded a few rootkit drivers used for hiding files and processes
update Terminate and remove current version, replace with new version cleanup Uninstall
It allows the attackers to grab the administrator’s credentials from unpatched routers.
it uses the “Run as Trusted Installer” method... which uses a stolen winlogon process token to run process as SYSTEM
...с использованием легитимной программы certutil.exe и переданного параметра urlcache загружает с ресурса hxxps://fotamene[.]com/app/app.exe... Обратите внимание, что в созданной задаче применяется техника Living-off-the-Land ... с использованием certutil.exe.
...а также брутфорса серверов по протоколу SSH... Брутфорсеры паролей SSH. Используют очень небольшой словарь наиболее популярных слабых паролей;
It looks into the default gateway of the victim’s network... Once the component successfully connects to the device listening on port 8291
sendParentProcesses acquires machine_guid from the registry... and names of parent processes.
were identified as using the EternalBlue exploit to move into local networks and run Monero (XMR) cryptocurrency miners | it then attempts to exploit the device with the CVE-2018-14847 vulnerability, which affects the RouterOS system used on MikroTik routers.
the response contains the session and the port that Glupteba will connect to for retrieval of the proxying jobs | When launched, Glupteba sends the same beacon to its C&C... Beacon sent to the C&C: GET /stat?... HTTP/1.0
...запросы к /api/cdn на C2... с CDN загружается и запускается указанный исполняемый файл...
A compromised router will be configured as a SOCKS proxy to relay malicious traffic
We saw a remote server establish SMTP connections to different mail servers through the SOCKS proxy of compromised routers.
“The technique, named Blockchain Dead Drops (BDD), stores payloads in on-chain transactions and smart contracts where infected devices can retrieve them on demand.” The article explicitly maps it to “T1102.001 (Web Service: Dead Drop Resolver).”
« Blockchain Dead Drops (BDD) ... stocker des instructions de malware ou des configurations C2 sur des blockchains publiques » ; « Smart contracts sur Polygon utilisés comme résolveurs C2 ».
the dropper downloaded two undocumented components aside from the Glupteba malware
Модуль, «общающейся» с сервером злоумышленника по протоколу WebRTC...
263 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
50 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cryptomining botnet cited as using Bitcoin OP_RETURN transaction data to store malicious information.
Botnet described as using Bitcoin OP_RETURN data to store command-and-control information.
Cryptomining botnet whose operators used Bitcoin OP_RETURN transaction data to store malicious information.
A botnet component included in the STANDOFF package, contributing to persistent access and proxy/relay-style abuse of infected systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.