Thursday 6 October 15:00 - 15:30, Green roomWayne Huang (Proofpoint)
Sun Huang (Proofpoint)Existing research on the Asprox actors has focused primarily on the malware they spread, but little has been published on who they are, how they operate and spread malware, and what resources they own. In this rare talk, we will disclose our many years of deep research on this actor: for example, since their initial operation in 2007, the Asprox gang now owns 2+ billion compromised emails, 2+ million compromised web servers (backdoored with webshells), 0.9+ million compromised SMTP accounts (some of which belong to the US military), 0.4+ million compromised FTP accounts, and SSH access to 1200+ compromised servers.We will detail how they've evolved into their currently sophisticated infection infrastructure, including their multiple layers of distribution and command-and-control servers, their anti-detection proxy servers, their malware obfuscation tool chain, their means of infecting endpoints, their large-scale tool to auto-compromise websites and inject webshells, and their evolution in 2014 to Android malware and mobile botnets.We will study statistics such as daily downloads and conversion rate, and will explain their monetization methods within multiple underground economies, and the economics. Finally, we'll cover how we've managed to collect our data, how we analysed the data, and the many techniques we used in tracking this actor.Click here for more details about the conference.