Financial scams and malware-assisted remote access attacks are on the rise, as industrial-scale fraud operations continue to proliferate in Southeast Asia. Many countries in the region have issued official warnings over the past three years. However, tracing specific malware strains back to these notorious complexes remains a difficult challenge to this day.<\/p>\n\n\n\n
In collaboration with the Intel Threat expert team. Infoblox<\/a> – m\u1ed9t c\u00f4ng ty an ninh m\u1ea1ng c\u00f3 tr\u1ee5 s\u1edf t\u1ea1i California, Hoa K\u1ef3, Ch\u1ed1ng L\u1eeba \u0110\u1ea3o \u0111\u00e3 conduct an investigation<\/a> An Android trojan was operating from multiple locations, including the K99 Triumph City complex in Cambodia. This conclusion was reached based on technical analysis, testimony from escapees, and evidence obtained from within the complex by the victims of human trafficking themselves.<\/p>\n\n\n\n This complex has been widely recognized by the United Nations and numerous other organizations as a fraud hub with links to high-ranking, powerful politicians, and using forced labor to operate large-scale malicious text messaging, calling, and email campaigns.<\/p>\n\n\n\n A sudden surge in DNS queries from customers' cloud environments led Infoblox experts to discover a type of malware. Through analysis, the experts identified it as a platform. M\u00e3 \u0111\u1ed9c d\u01b0\u1edbi d\u1ea1ng d\u1ecbch v\u1ee5 (Malware-as-a-Service – MaaS)<\/a><\/strong> Sophisticated. This platform has the capability to:<\/p>\n\n\n\n Experts have also discovered hundreds of domain names used to attack victims, many of which were cleverly designed to impersonate government agencies. These DNS anomalies were first noted a year ago, but traces of this Trojan may date back to at least 2023.<\/p>\n\n\n\n An estimated 35 new domain names are registered each month. Among the customers using the solution... Infoblox Threat Defense Cloud<\/em>, The areas most severely affected were Southeast Asia, Europe, and Latin America. The highest number of inquiries were recorded from clients in Indonesia, Thailand, Spain, and Turkey, indicating the global reach and impact of this group of actors.<\/p>\n\n\nThe premise of the investigation<\/h2>\n\n\n\n
Malware-as-a-Service platform detected.<\/h3>\n\n\n\n
\n