Behind the Scenes: The Industry of Social Media Manipulation Driven by Malware
summary
Four years of traces link an IoT botnet called Linux Moos to a multilayered SMM economy: infected routers run proxies, a handful of whitelisted IPs each manage thousands of fake accounts, and Windows thick‑client automation tools control those accounts through per‑account proxies. Investigators cluster 343 reseller panels (66% on one IP), map panel as a service platforms that sell white‑label panels, measure buyer prices (median $95 for 10k followers; reseller median $22, cheapest $1.80) and estimate botnet capacity into tens of millions of monthly follows.
AI-written summary · about
chapters (61)
- 0:00Introduction
- 0:25Background
- 3:04Ecosystem
- 5:30Whitelisted IPS
- 6:53Traffic Analysis
- 9:28Automation Software
- 13:31Reseller Model
- 13:49HTTP Traffic
- 14:16Bulk Reseller Panels
- 14:31Reseller Panels Stand in Our Ecosystem
- 15:18Reseller Panels Are Similar
- 15:33Simple Investigation
- 15:58Simple DNS Query
- 16:32Perfect Panel
- 16:49Reseller Panels
- 17:01Panel
- 17:37Panel Demo
- 18:48Main Provider
- 18:58SMM Panels
- 19:23Other Methods
- 19:45Where Do We Stand
- 20:02IP Reputation
- 20:25Residential Proxy Providers
- 21:09Junior VIP
- 21:23New Actor
- 21:36Residential Proxy
- 22:15Valid Solution
- 22:39Lumen
- 23:04Loominatee
- 24:44Trend Micro
- 25:03Research Results
- 26:50Socks
- 27:51Bala Solution
- 28:36Geo IP Location
- 28:55Vala
- 30:17Resident Evil Understanding Residential IP Proxy
- 31:03Where Do We Stand Now
- 31:43The Customer Facing Seller
- 32:07The Follower Factory
- 33:14Eddy
- 33:34The Buyers
- 33:49Understanding Potential Buyers
- 34:51Content Analysis
- 35:19Entertainment Industry
- 35:39Personal Profiles
- 36:07Unexpected Profiles
- 36:57STD Testing
- 37:33Duck Face
- 38:26Beautiful Birth 33
- 39:28The Crunchy Part
- 40:19The Exercise
- 40:59How Much Could They Make
- 41:17Other People Making Money
- 41:52Exercise
- 45:12The Researcher
- 45:38What to do next
- 45:54Targeting the middlemen
- 46:19What is illegal
- 46:52Focus on the content
- 47:17Sources
- 47:29Outro
related talks
30mThe Hidden Layer of Cyberattacks
32mFriend or Replicant: How Attackers Automate and Disguise Themselves
31mWatching Commodity Malware Get Sold to a Targeted Actor
18mBehind enemy lines
52mInvestigating DDOS - Architecture Actors and Attribution
47mThe Secret Life of Enterprise Botnets
54mModern Malvertising and Malware web-based exploit campaigns
55mModern Malvertising ...