An investigation into the Fronton botnet revealed much more than its ability to perform DDoS attacks.
See also: Emotet botnet: Increased activity and transition to 64-bit drives
On Thursday, cybersecurity firm Nisos published new research revealing the inner workings of the unusual botnet.
The Fronton botnet made headlines in 2020 when ZDNet reported that a hacktivist group claimed to have breached a contractor for the FSB, the Russian intelligence agency, and published technical documents that appear to show the construction of the IoT botnet on behalf of the intelligence agency.
At the time, it was believed that the botnet was intended to carry out large-scale distributed denial-of-service (DDoS) attacks. However, after analyzing further documents related to Fronton, Nisos believes that DDoS attacks are just one of many possibilities.
See also: Microsoft takes control of ZLoader botnet infrastructure
Nisos says that Fronton is “a system developed for coordinated inauthentic behavior,” and the implementation of specific software, called SANA, suggests that the botnet’s true purpose could be disinformation and the rapid and automated spread of propaganda.
SANA consists of an online dashboard and a variety of features, including:
- Newsbreaks: tracks messages, trends and their responses
- Groups: bot management
- Behavior Models: functions for creating bots capable of imitating human social media users
- Response Models: reaction to messages and content, including breaking news
- Dictionaries: stores phrases, words, quotes, and comments for use on social media, including positive, negative, and neutral reactions
- Albums: stores sets of images for platform bot accounts.
SANA allows users to create social media accounts with generated emails and phone numbers and spread content across social networks, blogs, forums, and more. Additionally, users can set schedules for posts/reactions, and the configuration includes how many likes, comments, and reactions a bot should generate.
See also: Enemybot: Researchers identify new DDoS botnet
According to the researchers, Fronton operators can also determine how many "friends" a fake bot account.
As of April 2022, the web portal has moved to a different domain but is active.
Information source: zdnet.com
