Notorious Malware, Spam Host "Prospero" Moves to Kaspersky Lab

I am trying to temper my dislike for krebs, but it is getting difficult.

Kaspersky operates an autonomous system (AS) and "Prospero" has traffic routed through that AS. Microsoft and Google also route all sorts of malware and spam through their ASes.

>The routing through networks operated by Kaspersky doesn’t by default mean provision of the company’s services, as Kaspersky’s automatic system (AS) path might appear as a technical prefix in the network of telecom providers the company works with

Censorship shouldn't happen at the AS level, anyways.

Is this one of these stealth advertisements where cyber security companies teach you how to operate better malware under the pretense of warning the public?

Key takeaways from the article: Prospero is a Russian hoster trusted by top cybercrime groups. Especially popular is their bearhost brand, which provides great service since 2019 and openly invites you to operate botnets, brute-force attacks or phishing websites on their hosting service.

Kaspersky by contrast is barely mentioned in the original portion of the article, it's only the later updates that go into detail here

Edit: maybe stealth advertisement isn't quite the right word. I'm not implying monetary compensation or any business relation, only that better malware provides job security for the cyber security sector

Side note, If you are developing software that hacks anything WHY IN THE HELL would you have any antivirus software installed knowing full well that antivirus software extracts any detected virus and sends it elsewhere? For context that was the excuse for the 2017 ban of Russian antivirus firm....

Relevant: https://news.ycombinator.com/item?id=43229855

The problem(s) with Russia (as exactly like in China) is the following:

  1) a company like Kaspersky can easily be employing 1-5-10-50 KGB/FSB agents, even without them knowing about the existence of the other agents (so they rat on each other)
  2) a company like Kaspersky can be arm-twisted and/or knee-capped to knowingly employ 1-5-10-50 employees (similar to US three letter agencies operating in US companies)(room 641A)(NOBUS MS Exchange hole that was there for 20 years, etc)
  3) I remember as a sysadmin using McAfee ePO 20+ years ago to "check things and do stuff" on employees' PCs when my Microsoft SMS was not working
  4) Russia just like China have a different sense of "rule of law". The supreme law is the "national interest " and Xi/Putin and their apparatus-es define it very freely.

Aka Russian Cloudflare.

Ah, yeah, I already wondered why these guys were suddenly back... The tell-tale sign here is admission scam emails from name-alike-domains for (mostly) Indian and (some) US colleges (with the payload being, mostly, crypto harvesters), but these are pretty noisy due to being pretty similar to earlier attempts...

> Once Kaspersky discovered that the code its antivirus software detected on the NSA worker’s machine were not malicious programs but source code in development by the U.S. government for its hacking operations, CEO Eugene Kaspersky says he ordered workers to delete the code.

Krebs is ranking lower in my eyes with writing like that. First, that’s obviously malicious software. Secondly, this is muddling binaries and source code. Is the claim that Kaspersky gathered the source for malware off the machine? That’s not typical behavior. If the claim is it gathered the binary that was built, that feels like a nothing burger.

Even the response from Kaspersky makes Krebs seem alarmist for the sake of generating attention traffic rather than someone investigating if there’s anything out of the ordinary in the first place. Didn’t even give them a few days to respond before publishing the article.