Loading story…
The Ready to Ride cybercrime group was reported to have distributed Win32/Cycbot through a pay-per-install operation that began around September 2010 and largely focused on victims in the United States, where installation prices were reportedly highest. The group was described as originating in Russia and using the malware as part of a broader monetization model tied to compromised endpoints.
Win32/Cycbot was used to support black-hat SEO operations, including search-result hijacking, clickjacking, JavaScript injection, and HTML modification. The malware communicated with hardcoded command-and-control servers, gathered host and antivirus details, changed browser proxy settings, and gave operators the ability to download, execute, and delete files on infected machines.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
The domain readytoride.su, used by the Ready to Ride group to distribute Win32/Cycbot through partner-specific URLs, was registered. The infrastructure supported the group's pay-per-install malware operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported that an Amadey botnet campaign tracked as **`fbf543`** functioned as a large pay-per-install service rather than a single malware run, linking more than 100 samples across **24 malware families** over roughly 10 days. The operation used **`sys32[.]cc`** as a Cloudflare-fronted Amadey C2 while backend and payload hosting were tied to **`labinstalls[.]info`** at **`158.94.211.222`**, with additional delivery infrastructure including **`qpgroup[.]top`** and bulletproof hosting providers such as Omegatech, 1337 Services, and Podaon SIA. Researchers said the service likely served multiple criminal customers and assessed it as a financially motivated mid-tier cybercrime operation with likely ties to the CIS criminal ecosystem. The campaign delivered a broad mix of malware including **Vidar**, **LummaStealer**, **QuasarRAT**, **XWorm**, **SmokeLoader**, **Mirai**, and **ScreenConnect**, with Vidar appearing most often in 29 samples across two distinct lineages. Delivery methods included a Delphi PE wrapped in Inno Setup, confirmed **`version.dll`** sideloading, an HTA dropper abusing **`mshta.exe`** and **`curl.exe`** to fetch payloads from **`188.137.224.92`**, a fake Roblox executor using a modified VMware Tools binary, LimeWire-hosted payloads, and ConnectWise RMM MSI packages signed with legitimate certificates. The report said the operators mixed evasive tradecraft such as anti-VM checks, ping delays, XOR-encoded dead-drop resolvers, Cyrillic homoglyphs, and stolen or abused code-signing certificates with operational mistakes including a self-descriptive backend domain and predictable payload URL patterns.
Jun 29, 2026
Multiple active malware campaigns are using **trojanized installers** and social engineering—rather than software vulnerabilities—to gain initial access and then deploy credential theft or remote-control capabilities. Intel 471 reported a new Android banking trojan dubbed **FvncBot** targeting Polish mobile banking users by impersonating an *mBank* “security” app; the dropper prompts installation of an additional “Play” component and then abuses **Android Accessibility Services** for persistence and control, enabling **keylogging**, **screen capture**, and hidden **VNC-style remote interaction** to facilitate fraudulent transactions. Separately, Cyderes described an ongoing, large-scale piracy-channel campaign where cracked game installers hide behind a legitimate-looking **Ren’Py** launcher tracked as **RenEngine**, which decrypts and launches subsequent stages and introduces **HijackLoader** via techniques including **DLL side-loading** and module stomping; observed final payloads include **ACR Stealer** (and in some cases **Vidar**) to exfiltrate browser credentials, cookies, and crypto wallet data. Cybereason detailed a different installer-themed operation in Chinese-speaking communities delivering **ValleyRat/Winos 4.0** attributed to **Silver Fox APT**, notable for using the rare **“PoolParty Variant 7”** process injection (abusing Windows I/O completion ports and `ZwSetIoCompletion()` after duplicating a handle from `Explorer.exe`) plus a strengthened watchdog mechanism via injection into `Explorer.exe` and `UserAccountBroker.exe` to maintain persistence.
Jun 29, 2026
Researchers linked the **InstallCapital** pay-per-install (PPI) operation to the delivery of multiple malware families through fake warez sites, a WordPress plugin, and a sprawling but centralized domain network. The installer fetched available offers from infrastructure referenced through Pastebin, then delivered second-stage payloads to victims who matched campaign conditions. Across 2017 to 2020, investigators observed more than **500 offers** and nearly **200,000 domains** tied to the operation, with testing showing distribution of **Glupteba**, **Dreambot**, and **Legion Loader**, the latter later dropping **Raccoon Stealer**. One of the payloads, **Glupteba**, was documented as a modular malware platform spread via malvertising that expanded beyond a botnet into credential theft, proxy abuse, and resilient command-and-control. Its newer variants stole browser cookies, history, and credentials from **Chrome**, **Opera**, and **Yandex**; exploited **MikroTik** routers via `CVE-2018-14847` to steal administrator credentials and convert devices into **SOCKS proxies**; and used encrypted communications plus **Bitcoin `OP_RETURN` data** to recover updated C2 domains. The combined reporting shows how adware-style PPI distribution can serve as an initial access channel for more capable malware that steals data, hijacks network infrastructure, and maintains durable access.
Aug 15, 2026