In most cases seen by Kaspersky, the threat actors claim to be the original developers of the presented restriction bypass tool, filing a copyright claim with YouTube and then contacting the creator to offer a resolution in the form of including a download link they provide. The threat actors take advantage of the popularity of Windows Packet Divert (WPD) tools that are increasingly used in Russia as they help users bypass internet censorship and government-imposed restrictions on websites and online services. YouTube creators catering to this audience publish tutorials on how to use various WPD-based tools to bypass censorship and are being targeted by threat actors posing as the copyright holders of these tools. The creators, fearing they will lose their channels, give in to the threat actors' demands, and agree to add links in their videos to GitHub repositories that host the said Windows Packet Divert (WPD) tools. Kaspersky has seen this promotion of laced WPD tools take place on a YouTube video that generated over 400,000 views, with the malicious link reaching 40,000 downloads before it got removed. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. In other cases, the attackers contact the creator directly, impersonating the tool's developers and claiming that the original tool has a new version or new download link, asking the creator to change it on their video. Although the campaign discovered by Kaspersky primarily targets Russian users, the same tactics may be adopted for broader-scoped operations that also deliver higher-risk malware like info-stealers or ransomware. For evasion, it is loaded into a system process like 'dwm.exe' using process hollowing and pauses mining activity when the user launches monitoring tools like Process Explorer and the Task Manager.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 08 Mar 2025 16:00:19 +0000