Hacker News Reader

Wait. How does the malware author injecting themselves with their own malware lead to Malwarebytes getting screenshots of the attackers machine? Did they somehow breach the APT’s network or hijack the malware? Is there some context I’m missing behind this blog post?

View on HN

The malware appears to use a web based command and control server, so there could be a vulnerability in it, a easily brute forced password or even open access. For example, Zeus, the first major banking trojan, would store logs for each infected victim in a folder on its web server. If the owner was careless, these would be exposed in an open directory. If this was the case, the very first folder would almost always be a test infection of the owner, and the very first password capture in it would be the owner logging into the control panel to see if it was working. Good fun back in the day.

In Figure 3 you can see what looks like a webshell. They probably found a way to upload php files to the server which allowed them to do anything.

Alternatively, they might have guessed the password and then uploaded the file from the web gui.

Reply on news.ycombinator.com