Recently fileless malware is being discovered in computers across the world. What makes this so hard to detect is that it does not have a file or "artifact" on the computer to be found by antivirus software. Because it does not have to write anything to a computer, it can also run on any operating system, including unix.
So what are these programs mostly doing? they are executing scripts that encrypt their traffic, and farming clicks.
They are not keylogging, they are not configuring ports, they are farming clicks.
This raises tons of questions: Is it more profitable for a cybercriminal to farm clicks than do industrial espionage? Are the companies deliberately putting this on their computers, pretending to be hacked, then making extra cash on the side to change the narrative?
We left reddit because of the vote manipulation. We see all the bot twitter posts, but we never asked where they came from. We assumed it was from china, but if a shareholder where to sue twitter or reddit over paid vote manipulation, then the click farms in china would easily be discovered.
With the discovery of the file less malware thanks to the leaked NSA tools, we now have a more disturbing picture: Many computers are compromised, and are running hard to find botnets that solely generate site traffic and manipulate online marketing.
view the rest of the comments →
bezzy ago
If malare is only in RAM then a simple reboot wipes it. Click farming malware is mostly used to generate ad revenue.
senpaithatignoresyou ago
Not on the ram. This was also on a unix machine, windows 7 and 10 machines too.
bezzy ago
Fileless means in RAM. There is no other place for data to be. Either it's on disk and therefore there are files or it is not and then it's in RAM. If data is not written to disk and does not exist in RAM, then where is it? In the cache? Search fileless malware. It's all about existing in ram and leveraging something like PS. The only way to achieve persistence across reboots is to write to a disk, at which point it isn't truly fileless.
WarGy ago
It could be in the CPU cache, couldn't it? There's also been a few cases of malware written into the BIOS flash memory.
bezzy ago
Perhaps, I don't know enough about CPUs. At any rate that would be a very tiny virus. If something is written to BIOS then it still is not fileless.