After Twitter was itself recently crippled by a cyberattack, new evidence indicates the microblogging site has been used as the key part of an information-stealing botnet operation, said Jose Nazario, manager of security research at Arbor Networks.
Nazario last week discovered a Twitter account that was being used as a command-and-control hub to issue instructions to infected computers that are part of a botnet. Tweets coming from the malicious account, called “upd4t3,” were encoded and looked like a random combination of letters and numbers. But the tweets were actually being used to issue new instructions to bots.
The account since has been suspended.
“These were existing infected PCs and the master piece of malware was listening to the status updates on the Twitter command to update the malware on the machine,” Nazario told SCMagazineUS.com.
The malware on the zombie machines was being updated via Twitter every few hours to avoid anti-virus detection, Nazario said. The majority of the infected computers are located in Brazil, and the purpose of the criminal operation appears to be stealing login credentials for Brazilian banks.
Twitter quickly took down the account after Nazario notified them about it, he said. The bot herder, however, is likely using other Twitter accounts for the same purpose, and other criminals may be using this method too.
“It's not the only botnet using Twitter, and now we begin the process of finding more,” Nazario said.
He added that Twitter likely was used as the control center because, with millions of members, it makes for an easy place to hide.
See original article on scmagazineus.com
Twitter used as botnet command-and-control hub
Researchers have discovered that Twitter messages were used to issue new instructions to bots.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers

See everything. Do more.

Lindentech Secures Digital Identity with Zero Trust and Microsoft Entra

Diamond IT Delivers GRC Transformation with Microsoft Purview

Linktech Powers Energy Trader’s Essential Eight Compliance in Just Eight Weeks

Byte Delivers Future-Ready IT: Transforming Endpoint Security and Productivity with a Cloud-First Strategy