Malware
malware:bayrob
Also: Bayrob malware, Bayrob virus
Malware that manipulated eBay browsing sessions and supported a broader criminal operation involving fraud, botnet services, credential theft, cryptocurrency mining, and proxying.
Malware that manipulated eBay browsing sessions and supported a broader criminal operation involving fraud, botnet services, credential theft, cryptocurrency mining, and proxying.
“I decided to call it Bayrob ‘cause they were robbing customers of eBay.”
“The botnet reached the maximum of about 450,000 machines”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DISCOVERED_BY | Liam O’Murchu | Explicit | 175 |
| outgoing | ATTRIBUTED_TO | Bayrob Group | Explicit | 175 |
| outgoing | TARGETS | eBay | Explicit | 175 |
| outgoing | USES | browser session injection | Explicit | 175 |
| outgoing | USES | phishing | Explicit | 175 |
| outgoing | USES | geofencing | Explicit | 175 |
| outgoing | USES | Money mule | Explicit | 175 |
| outgoing | USES | command-and-control infrastructure | Explicit | 175 |
| outgoing | USES | cryptocurrency mining | Explicit | 175 |
| outgoing | EXPLOITS | unencrypted Jabber attachments | Explicit | 175 |
| incoming | INVOLVES | Bayrob campaign | Explicit | 175 |
Bayrob DISCOVERED_BY Liam O’Murchu
Liam received and investigated the malware sample that became Bayrob, discovering how it worked and how the criminals used it.
Explicit Confidence 93% · Liam O’Murchu EP 175 Details
“I got this file that I wanted to analyze”
Bayrob ATTRIBUTED_TO Bayrob Group
The episode presents Bayrob as the malware operated by the Bayrob Group, while describing the group as the criminals behind the fraud.
Explicit Confidence 94% · Jack Rhysider EP 175 Details
“the Bayrob malware campaign”
Bayrob campaign INVOLVES Bayrob
The Bayrob campaign involved the Bayrob malware.
Explicit Confidence 99% · Jack Rhysider EP 175 Details
“the Bayrob malware campaign”
Bayrob targeted eBay customers by intercepting visits to the eBay website and presenting fraudulent auctions.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“they were trying to defraud customers of eBay”
Bayrob USES browser session injection
Bayrob intercepted eBay connections and injected false information into the victim’s browsing session.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“it would intercept your connection and it would inject false information into your browsing session”
The malware was distributed through phishing emails and Craigslist posts.
Explicit Confidence 98% · Jack Rhysider EP 175 Details
“specifically through phishing e-mails and Craigslist posts”
Bayrob USES geofencing
The attackers geofenced the fraud so it would operate only in America and selected locations within the United States.
Explicit Confidence 99% · Liam O’Murchu EP 175 Details
“the attackers were geofencing their fraud so that it could only happen in America”
Bayrob USES Money mule
Bayrob’s operators used money mules to receive victims’ payments and forward the money through additional intermediaries.
Explicit Confidence 97% · Jack Rhysider EP 175 Details
“the criminals hired someone else to collect that money, keep a portion of it, and then forward the rest”
Bayrob USES command-and-control infrastructure
Bayrob communicated with and used a multi-layer command-and-control infrastructure.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“they had a multi-layer command-and-control infrastructure”
Bayrob USES cryptocurrency mining
The malware-controlled systems were instructed to join mining pools and mine cryptocurrency for the group.
Explicit Confidence 99% · Ryan Macfarlane EP 175 Details
“We saw them instructing these computers to join mining pools and mine cryptocurrency for them”
Bayrob EXPLOITS unencrypted Jabber attachments
The operators’ use of Jabber exposed unencrypted attachments, allowing investigators to extract spreadsheets and screenshots from the network traffic.
Explicit Confidence 94% · Jack Rhysider EP 175 Details
“attachments are not — it doesn’t default to encryption”