Approximately 400,000 users were saved from being infected by malware in a 12‑hour attack that was caused by a backdoor in a Russian BitTorrent client named MediaGet.
The event took place last Tuesday, and Microsoft said that the Windows Defender team detected and stopped the massive operation that tried to infect mainly Russian and Turkish users with the Dofoil (Smoke Loader) trojan. Microsoft published an in-depth report on how the malware works.
The story began last month when some malicious users broke the MediaGet infrastructure and managed to replace the official MediaGet installer with an identical one that also contained a backdoor. Then I waited a period of two weeks so that users would install or update to the new MediaGet versions that contain the backdoor. Then, in early this month, they used the backdoor to install various malware on users' computers and launched their main attack on March 6, attempting to deliver the Dofoil Trojan together with a coinminer malware for the cryptocurrency Monero. During their attack, the scammers also used a stolen digital certificate to sign the backdoored MediaGet update in order to evade various antiviruses, etc. Microsoft published more details and, according to the Windows Defender team, the malicious Dofoil software infected users' computers via a file named my.dat, which was created by mediaget.exe of MediaGet BitTorrent.
This particular method of attack and the overall scheme is not something new, as we have previously seen similar situations where hackers replace a program on its official website with a malicious one, in order for users to download it.
