Hackers Often Use Legitimate Software in Attacks to Mask Themselves from Antiviruses

Hackers often use legitimate software for their purposes. It helps them stay invisible to antiviruses and other security systems. This was stated by Alexey Lednev, Head of Expertise at PT Expert Security Center in Positive Technologies.

The antivirus may not notice the use of such tools or mark them as unwanted software. Usually, this does not cause an immediate reaction from cybersecurity specialists.

As an example of how software can be misused, the expert mentioned Ngrok. This software allows you to turn a regular computer into a server that can emulate the launch of a website or software with online functions.

This function is often used by developers to demonstrate pre-release versions of their products to customers or colleagues. When using Ngrok, the developer provides customers or colleagues with access to the product and, therefore, to their computer via a secure channel called a "tunnel."

According to Lednev, attackers often install Ngrok on infected computers. They use this software to control the victim's system. Since Ngrok is considered legitimate software, security systems may not recognize it as a threat and пропускать traffic between the infected computer and the hacker's device.

Earlier it became known that the Cabinet continues to improve laws against fraudsters. New initiatives give силовым структурам the right to block funds in citizens' accounts without a court order. This is aimed at combating cybercrime and theft. The blocking will last no more than ten days and will only affect the stolen amount.

Read also on the topic:

Criminal liability is to be introduced for droppers in Russia

Almost half of the programs that replaced iOS applications are dangerous

Fraudsters began to deceive Russians through fake delivery from PVZ

Fraudsters offer "help" to victims of fraud: how not to become a victim of a new scheme