Type Trojan horse Operating system(s) affected | Isolation c. 2010 | |
 | ||
Subtype Remote administration trojan Author(s) | ||
Blackshades rat in action hackers arrested worldwide for malware that allows rat backdoor hacking
Blackshades is the name of a malicious trojan horse used by hackers to control computers remotely. The malware targets computers using Microsoft Windows -based operating systems. According to US officials, over 500,000 computer systems have been infected worldwide with the software.
Contents
- Blackshades rat in action hackers arrested worldwide for malware that allows rat backdoor hacking
- Global arrests for blackshades hacking software
- Functionality
- Detection and removal
- Blackshades in the media
- FBI crackdown
- References
In 2014, the United States Federal Bureau of Investigation (FBI) arrested one hundred people who had Blackshades in their computer. Before the FBI crackdown, Blackshades was sold for US$40, and reportedly generated US$350,000 in sales.
Global arrests for blackshades hacking software
Functionality
Blackshades infects computer systems by downloading onto a victim's computer when the victim accesses a malicious webpage (sometimes downloading onto the victim's computer without the victim's knowledge, known as a drive-by download) or through external storage devices, such as USB flash drives. Blackshades also included tools that assisted hackers in maximizing the amount of computer systems infected, such as a tool that sends infected links that masquerade as an innocuous site to other potential victims via the victim's social networking service.
Blackshades can reportedly be used remotely to access an infected computer without authorization. Blackshades allows hackers to perform many actions on an infected computer remotely without authorization, including the ability to:
Blackshades reportedly can be used by computer hackers with little experience or by script kiddies, hackers that use programs developed by others to attack computer systems.
Blackshades can also act as ransomware. Hackers using Blackshades can restrict access to the victim's computer and demand a ransom paid to the hacker in order for the restriction to be lifted.
Detection and removal
Many antivirus programs can successfully detect and remove Blackshades, however hackers using the Blackshades software usually avoid detection of Blackshades infections by using software that obfuscates the Blackshades binary to avoid detection by antivirus programs, which the Blackshades organization also sold along with the Blackshades software.
Blackshades in the media
In 2012, Citizen Lab and EFF reported on the use of Blackshades to target opposition forces in Syria.
In 2015, Stefan Rigo from Leeds was given a 40-week suspended sentence for using BlackShades against 14 people, 7 of whom he knew personally. It is reported he paid for the software using his ex-girlfriend's payment card.
FBI crackdown
In 2012, the FBI ran a sting operation called "Operation Card Shop", which led to 24 arrests of hackers in eight countries. One of those arrested was Michael Hogue (also known as xVisceral in online hacking communities). Hogue, a co-creator of Blackshades, was arrested and indicted on charges under 18 U.S.C. § 1030, more commonly known as the Computer Fraud and Abuse Act. He was sentenced to 20 years in prison.
In 2014, the FBI coordinated a worldwide operation to combat the use of the malware, leading to the arrest of almost one hundred people in nineteen countries. On May 19, charges were laid in the United States against five individuals: two men identified as developers of Blackshades and three other men who sold the software or used it to infiltrate other people's computers. Exactly 359 searches were conducted and more than 1,100 electronic devices have been seized as part of the operation. According to the FBI, over 500,000 computers in more than 100 countries were infected by the malware. Blackshades sold typically for US$40, and reportedly generated US$350,000 in sales.