Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Webhards And Torrents. Show all posts
Webhards And Torrents
Cyber Attacks data security ISP Malware Attack Service Provider South Korea User Privacy Webhards And Torrents

Korean ISP Accused of Installing Malware to Block Torrent Traffic

 

A major scandal has emerged in South Korea, where the internet service provider KT is accused of intentionally installing malware on the computers of 600,000 subscribers. This invasive action was reportedly designed to interfere with and block torrent traffic, a move driven by the financial pressures associated with the high bandwidth costs of torrenting. This revelation has significant implications for user privacy and the ethics of ISP practices. 

According to an investigative report by Korean outlet JBTC, KT—formerly known as Korea Telecom—took extreme measures to combat torrenting. Despite a decrease in filesharing traffic over the years, torrenting remains popular in South Korea, particularly through Web Hard Drive services (Webhard). These services use the BitTorrent-enabled ‘Grid System’ to keep files available, leading to significant bandwidth usage that caught the attention of ISPs like KT. KT, one of the largest ISPs in South Korea, had previously been involved in a court case in 2020 over throttling user traffic, citing network management costs. 

The court ruled in KT’s favor, but new reports indicate the company went beyond merely slowing downloads. Users of Webhard services began experiencing unexplainable errors and service outages around four years ago, all of whom were KT subscribers. JBTC’s investigation uncovered that KT had installed malware on these users’ computers, causing these disruptions. A dedicated team at KT, consisting of sections for malware development, distribution and operation, and wiretapping, allegedly planted malware to eavesdrop on subscribers and interfere with their file transfers. This malware not only limited torrent traffic but also allowed the ISP to access and alter data on users’ computers, raising serious legal and ethical concerns. 

The Gyeonggi Southern District Police Office, after conducting a search and seizure of KT’s data center and headquarters, believes the company may have violated the Communications Secrets Protection Act and the Information and Communications Network Act. In November last year, police identified 13 people of interest, including KT employees and employees of partner companies. 

The investigation is ongoing, with a supplementary probe continuing since last month. KT’s actions, ostensibly aimed at reducing network management costs, now appear likely to result in significant legal repercussions and potential financial losses. This case highlights the need for stricter regulatory oversight and transparency in ISP practices to protect consumer privacy and maintain trust.
Read more »
ZIP File
malware South Korea Webhards And Torrents ZIP File

Threat Actors are Using Webhards And Torrents to Spread RAT Malware in Korea

 

The ASEC researchers have discovered a new malicious campaign targeting South Korean users. Threat actors are spreading easily obtainable malware such as njRAT and UDP RAT via Webhards and torrents to disguise as normal programs such as games or adult content for distribution. 

According to ASEC analysts, WebHards is a popular online storage service in Korea, preferred mainly for the convenience of direct downloads. However, threat actors are using Webhards to distribute a UDP RAT that is disguised as a ZIP file containing an adult game. Users who end up at webhards are directed by attackers through Discord or social media platforms. 

The downloaded compressed zip file has various files but then the user would need to open the “Game..exe” file to play the game. Upon execution, the “Game..exe” file becomes hidden, therefore, the user then uses Game.exe, which is the copied game program launcher. 

Apart from that, the stick.dat file that runs via launcher malware is the ALZIP SFX program, and it creates two malware “Uninstall.exe” and “op.gg.setup.apk” in the C:\Program Files\4.0389 folder. After stick.dat creates the files, it executes Uninstall.exe. Uninstall.exe is another launcher malware that runs op.gg.setup.apk. Op.gg.setup.apk is a downloader malware that downloads the Op.gg.exe file from the following address in the same directory and runs it.

njRAT is a type of malware that can steal private information from victims, such as account credentials and keystrokes. The malware is also capable of capturing screenshots from a compromised device and can modify the Windows registry for persistence. This variant adds a Registry key to ensure a continuous connection to the C2 server. It allows the attackers to drop more payloads. 

Threat actors have been employing various tricks to convince users to download the njRATs with torrents and file hosting services being a preferred method. Earlier this year in June, ASEC warned about this issue, when threat actors propagated a repackaged version of a well-known game as Lost Ruins. The package could run both the game and the virus simultaneously, making it hard to detect the infection. 

The researchers have advised users to remain vigilant while approaching executables downloaded from a file-sharing website and also to download products from the official websites of developers.
Read more »
Subscribe to: Posts (Atom)