Security researchers from Facebook have identified a new variant of the Sefnit click fraud malware program that uses SSH for command and control instead of the Tor anonymity network.
The threat, which is also known as Mevade, infected millions of computers last year and caused a sudden spike in Tor usage.
Sefnit is a family of malware programs that has been used to defraud advertisers by generating rogue ad clicks since at least 2011, according to an analysis in September by researchers from the Microsoft Malware Protection Center.
In mid-August, a Sefnit variant called Mevade caused the number of daily users on the Tor anonymity network to rise from around 500,000 to over 3 million because it used a Tor Hidden Service—a website accessible only from inside the Tor network—as a command-and-control (C&C) server.
Unlike older Sefnit variants that hijacked user clicks on search results, Mevade used a different click fraud technique that involved transforming infected computers into proxies for routing fraudulent ad click traffic.
It’s not clear how well Tor worked as a C&C channel for Mevade’s authors given that traffic over the anonymity network can be slow, especially when overcrowded with clients. Poor performance might explain why a new version of Sefnit recently analyzed by researchers at Facebook no longer relies on Tor.
Instead, the new variant uses the Plink (PuTTY link) command-line network connection tool to access C&C servers over the SSH (Secure Shell) protocol, the Facebook Security Team said Monday in a blog post that contains details about the new threat.
The use of Plink further indicates that Sefnit’s authors have a tendency to repurpose legitimate software for their goals. This behavior was previously observed with Tor and 3proxy, a free proxy server program.
“This post references additional files, domains and artifacts, including the SSH functionality in channel.dll,” the Facebook researchers said. “We hope these details and indicators help security teams audit their assets for signs of Sefnit.”