3 ms·
To be clear, I'm not suggesting that it isn't Ukranian, or whatever, I was just pointing out the fact that the interface, etc., is in English and so there may b
by waterphone 10y ago
To be clear, I'm not suggesting that it isn't Ukranian, or whatever, I was just pointing out the fact that the interface, etc., is in English and so there may be a wider "market" for the malware. It's consistent with the sort of malware I see on clients' infected WordPress installs semi-regularly.
- codedokode 10y agoI tried to Google "pas web shell" and "profexer pas download" (with option to search pages in any language) to understand the audience of a project. What I saw were mostly links to forums in russian (with reviews of the software or tutorials on how to use it), one chinese github account with a collection of web shells and english posts from people who found the backdoor and tried to understand what it was. So I got an impression that posts in english were mostly from victims and posts in russian were mostly from users. You can try google these words and see the results yourself.
- zzzcpan 10y agoThe international market exists, but there is no evidence of the malware having any positions there or any efforts to promote it there, which is how things usually are. So, it is used mostly by Russians and Ukrainians and is known almost only among them. If you believe the intelligence agencies, it's only logical to believe that Russians did in fact do it. Simple estimates based on the things that we know about the world don't suggest other possibilities. Not that it matters though. Russia already did a lot worse, but US officials were so afraid to call it out, even downing MH17 was presented as if Russia "helped rebels" and didn't do it itself.