Cracked Software Leads To Nitol DDoS And Amadey Bot Malware

Victims searching for cracked versions of the Hangul or MS Office software have inadvertently also obtained the Nitol DDoS malware as a bonus. Once the setup file is executed the Nitol malware communicates with the attackers C2 server, gathers information to be sent back to the attackers from the victim's system, receives directions to either perform DDoS functions, obtain additional payloads, or destroy the MBR. If the master boot record is destroyed upon reboot "Game Over" is displayed and rebooting may be impossible. In recently investigated campaigns the Nitol malware was used to download and execute the Amadey Bot malware that was disguised as other utilities such as AnyDesk, TeamViewer, Explorer.exe and ServcieManager.exe. The combination of the Nitol malware and Amadey Bot allow the attackers to perform functions from DDoS attacks to additional payload retrieval and data theft.