A group of miners have been seen creating, advertising and selling various strains of malware and ransomware on Discord, earning pocket money for themselves.
Avast cybersecurity experts recently discovered a Discord server where a group of hackers were discussing creating, updating, and selling malware families like Lunar, Snatch, and/or Rift.
Upon closer inspection of the discussion, the researchers concluded that the group was made up primarily of minors, as they kept mentioning their parents and teachers, while hurling various age-related insults at each other.
To join the group and essentially become the malware-as-a-service user, you have to pay a fee, which varies between 5 and 25 euros. Avast says that up to 100 accounts have paid to access the group.
deception and deceit
The group in question creates and markets various types of malware, including those with password-stealing capabilities, data stealers, those capable of mining various cryptocurrencies for attackers, and in some cases even running ransomware attacks.
When it comes to distributing malware, the process is more or less standard, with a little twist. Scammers create a YouTube video, demonstrating a crack for commercial software or a popular computer game, and include a download link for the fake crack in the description.
To help reinforce authenticity, other members of the Discord group then add comments to the video, thanking the author for their contribution and "confirming" that the file at the download link is actually legitimate.
This, according to Avast, is much more sinister than the usual practice of using bots to add comments, as it is nearly impossible to detect fraud when genuine accounts support video.
Spreading ransomware, data thieves, and other malware can be an illegal and malicious practice, but with this group, in many cases, it all comes across as a joke, Avast concluded.