BlackTDS: new Traffic Distribution System

According to Proofpoint researchers revealed that a new type of traffic distribution system (TDS) that spreads malicious software has appeared on the dark network, and the researchers named it “BlackTDS.” Since the end of December 2017, BlackTDS’s “owners” have been promoting in the underground market, and have been able to deploy attack kits (EK) and malware in a cost-effective manner.

BlackTDS can provide a variety of services and collectively referred to as Cloud TDS. The “masters” of BlackTDS claim that Cloud TDS can handle social engineering issues and redirect to EK while preventing researchers and sandboxes from discovering.

BlackTDS is a TDS-as-a-service offering that is generally not as comprehensive as other TDS services. It requires threatening attackers to direct their traffic to BlackTDS, and BlackTDS promises to use the victim’s profile data to optimize its attack toolkit or malware that infects users.

The traffic distribution system acts as a “drive-by” who can trade traffic between websites. These systems create value by filtering traffic based on the user’s browser, IP address, geographic location, and user agent data. When a user clicks on a link in the TDS chain, such a system will be secretly redirected to a malicious web page based on his personal data. The TDS system became notorious for helping criminals spread Web-based malware through attack tools and spurious downloads.

Proofpoint stated that they have repeatedly found the BlackTDS infection chain, which spreads malicious software through fake software updates and other social engineering solutions. BlackTDS seems to be highly scalable and easy to deploy, greatly reducing the threshold for hackers, Cloud TDS is also relatively cheap, and the starting price is:

• $6/1 day;
• $45/10 days;
• $90 monthly.

Cloud TDS advertised that non-abuse-based Cloacking antibot TDS costs just $3 a day without using its own server to receive traffic. This is equivalent to off-the-shelf traffic solutions on darknets.

Proofpoint stated that malware as a service is becoming more and more common. In this case, CloudTDS provides services that include components that host and configure complex off-the-shelf downloads. BlackTDS’s low cost, ease of access, and relative anonymity have greatly reduced the barriers to the spread of Web malware. Because of its support for social engineering and its flexible approach of directly distributing malware or simply redirecting victims to EK landing pages, BlackTDS highlights the gradual maturity of crime software as a service.

This service allows threat attackers to select malware or EK APIs and then handle follow-up of malware distribution.

Kevin Eppstein, vice president of threat operations at Proofpoint, explained that the actual redirection, filtering and hosting of social engineering templates and user-oriented mechanisms after a road-to-door attack are all handled by this cloud-based service. Threat attackers only need to provide traffic, Payload, or EK access.

Proofpoint mentioned a case in which the attacker TA505 used the BlackTDS service to launch a massive spam campaign on February 19, 2018. The TA505 sends spam emails to users with PDF attachments that contain links to the BlackTDS chain.

Proofpoint pointed out that the Web-based attack chain increasingly integrates social engineering and leverages the existing underlying infrastructure and human error.

Source, Image: Proofpoint