Prometheus TDS – A Whole New Cybercrime Ecosystem

August 19, 2021

Topics

Cybersecurity
Malware

PerimeterWatch’s Threat Intelligence Team has discovered a post by threat actor “Inc.”, a premium user on the Russian DarkWeb forum XSS. According to “Inc.”, security firm Group-IB discovered a service called Prometheus TDS (Traffic Direction System), that allows other malware groups to spread their malicious payloads. According to the post, malware samples were being spread via compromised web servers using the services of Prometheus TDS.

DarkWeb Intelligence

The concept behind Prometheus TDS is that malware operators can rent the platform via subscription. Prometheus TDS is used to scan the last of hacked websites to deliver its own backdoor, “Prometheus.Backdoor”, to the compromised servers. Afterwards, subscribers can begin sending spam emails, which will contain malicious links to the hacked websites that eventually delivers the desired malware. If a user clicks on the links in the email, the Prometheus backdoor examines the victim’s browser information and redirects the unsuspecting user to a safe webpage or to a webpage hosting the malware.

Prometheus TDS has been promoted on the DarkWeb forums since 2016 but has recently gained traction evidenced by the number of views and replies on the thread post. The pricing for Prometheus TDS services ranges from:

$30 USD for two days
$100 USD for a week
$150 USD for two weeks
$250 USD for a month

Based on the forum posts, it is seen that Prometheus TDS continues to grow its services as updates were added about new services such as, “Checker for Outlook & Office365 accounts and cookie checker for Outlook & Office365 accounts”.

Threat Analysis

The implementation of the Prometheus TDS service is extremely alarming. According to recent reports related to the Prometheus TDS malware campaigns, evidence of Campo Loader, Hancitor, QBot, Beur Loader, SocGhoulish, and IceID were discovered. These malware strains are some of the most dangerous malware being spread today, and they were involved in the earlier stages of ransomware attacks over the last few years such as in Ryuk, Conti, and REvil. The Prometheus TDS service opens the flood gates for malware operators to spread their malicious programs continuously and easily. And as this service becomes more and more popular, other threat actors may follow suit and use the Prometheus TDS to spread their malware.

Conclusion

With Prometheus TDS it is evident that the threat landscaped has changed. Cybercrime is no longer made up of just people who create malware, instead, in most malware campaigns there are multiple groups working together to provide different services. Such services include spam-sending services. As noted, the main vector of attack for the Prometheus TDS is through spam emails. Phishing and spear phishing attacks are amongst the most common type of cyberattacks. According to PurpleSec, 92% of malware is delivered by email. With Prometheus TDS streamlining the malware campaign, more and more malware delivery through email will be seen. Evidently, the need for proper email protocols and email security must implemented in all organizations. With email security, the chances of malicious emails getting through can be reduced greatly. In the end, as the cybercrime ecosystem changes, so must organizations in their security implementations.

Prometheus TDS – A Whole New Cybercrime Ecosystem

DarkWeb Intelligence

Threat Analysis

Conclusion

Up Next

Black Cat Attack on UnitedHealth Group

Chinese Hackers Exploit FortiOS Vulnerability