4 ms·
> The web shell is made by a Ukranian group but there is absolutely no reason to believe the people who used the web shell are Ukranian, nor is there any reason
by Lazare 10y ago
> The web shell is made by a Ukranian group but there is absolutely no reason to believe the people who used the web shell are Ukranian, nor is there any reason to believe whoever hacked the DNC uses the newer version.
I don't believe the comment you are replying to said otherwise.
The point is that the report made the link: "We found Russian malware, so it must be the Russians." And in reality it's not Russian malware, and as you point out, finding out who wrote it doesn't tell you who used it.
- dimino 10y agoThat is what the commenting I'm replying to said, and it was incorrect to say so.
- Lazare 10y agoThat's how you interpreted it. Since other people interpreted it differently, perhaps it was less clear than you imagined.
- zzzcpan 10y agoRussians are the most likely users of the Ukrainian-made malware either way as the most likely place for them to promote it is russian-speaking cyberspace they share with each other without a language barrier.
- waterphone 10y agoIt's distributed in English with an English interface.
- codedokode 10y agoThe support forum thread started by the developer is in russian (many people living in Ukraine speak both Russian and Ukranian so there is no contradictions with an Ukranian flag on the download page): https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567
- zzzcpan 10y agoAnd the author of the thing on the last page claims that many "packers" can be made to satisfy that signature.
- codedokode 10y agoMaybe he understood that things got serious and doesn't want to get extradited to USA.
- zzzcpan 10y agoDoesn't mean anything, the thing is still way more likely to be promoted inside the community than reaching international recognition or any international users really.
- codedokode 10y agoThe download page earlier [1] had a Webmoney wallet identifier for donations. Webmoney is a russian payment system that was popular in 00's [2] in ex-soviet countries. [1] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [2] https://en.wikipedia.org/wiki/WebMoney https://en.wikipedia.org/wiki/WebMoney
- waterphone 10y agoTo be clear, I'm not suggesting that it isn't Ukranian, or whatever, I was just pointing out the fact that the interface, etc., is in English and so there may be a wider "market" for the malware. It's consistent with the sort of malware I see on clients' infected WordPress installs semi-regularly.
- codedokode 10y agoI tried to Google "pas web shell" and "profexer pas download" (with option to search pages in any language) to understand the audience of a project. What I saw were mostly links to forums in russian (with reviews of the software or tutorials on how to use it), one chinese github account with a collection of web shells and english posts from people who found the backdoor and tried to understand what it was. So I got an impression that posts in english were mostly from victims and posts in russian were mostly from users. You can try google these words and see the results yourself.
- zzzcpan 10y agoThe international market exists, but there is no evidence of the malware having any positions there or any efforts to promote it there, which is how things usually are. So, it is used mostly by Russians and Ukrainians and is known almost only among them. If you believe the intelligence agencies, it's only logical to believe that Russians did in fact do it. Simple estimates based on the things that we know about the world don't suggest other possibilities. Not that it matters though. Russia already did a lot worse, but US officials were so afraid to call it out, even downing MH17 was presented as if Russia "helped rebels" and didn't do it itself.
- sv123 10y agoIsn't part of Ukraine now Russia? Sooo.....