{"id":5617,"date":"2024-10-03T04:55:55","date_gmt":"2024-10-03T09:55:55","guid":{"rendered":"https:\/\/www.darkreading.com\/endpoint-security\/ai-nude-photo-generator-delivers-infostealers"},"modified":"2024-10-03T04:55:55","modified_gmt":"2024-10-03T09:55:55","slug":"ai-nude-photo-generator-delivers-infostealers-instead-of-images","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/10\/03\/ai-nude-photo-generator-delivers-infostealers-instead-of-images\/","title":{"rendered":"AI ‘Nude Photo Generator’ Delivers Infostealers Instead of Images"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

The notorious <\/span>FIN7 threat group<\/a><\/span> is combining artificial intelligence (AI) with social engineering in an aggressive, adult-themed threat campaign that dangles lures for access to technology that can “deepfake” nude photos \u2014 all to fool people into installing infostealing malware.<\/span><\/p>\n

The powerful Russian financial cybercrime group has created at least seven websites that advertise for what’s called a “DeepNude Generator,” which promises to use deepfake technology transform any photo into a nude representation of the person pictured, according to <\/span>new research<\/a><\/span> from the threat hunters at Silent Push.<\/span><\/p>\n

People can either download the generator via the site or sign up for a “free trial,” demonstrating the sophistication of the scam. But instead of receiving the tool, they end up downloading malicious payloads such as the stealers Lumma and Redline, which can be used to deliver further malware such as ransomware, the researchers said.<\/span><\/p>\n

Given the provocative lure, organizations are vulnerable to the campaign, as it may entice  unsuspecting employees to download malicious files. “These files may directly compromise credentials via infostealers or be used for follow-on campaigns that deploy ransomware,” according to a blog post about the research.<\/span><\/p>\n

Meanwhile, FIN7 also continues to promote an existing malvertising campaign that targets corporate users with lures to content by popular brands \u2014 including  SAP Concur, Microsoft, Thomson Reuters, and FINVIZ stock screening \u2014  to spread the <\/span>NetSupport RAT<\/a><\/span> and .MSIX malware, according to Silent Push. The researchers identified a number of active IPs and thus “active new websites” hosting the ploy, which asks people to download a fake “required browser extension,” which is actually a malicious payload, to view content related to the brands.<\/span><\/p>\n

Related:<\/span>Python-Based Malware Slithers Into Systems via Legit VS Code<\/a><\/p>\n

Fin7 Evolves With the Times<\/h2>\n

The DeepNude Generator campaign demonstrates particularly sophisticated thought and planning on the part of FIN7, which developed at least seven dedicated websites URLs \u2014such as aiNude[.]ai, easynude[.]website, and ai-nude[.]cloud \u2014 to make it appear convincing.<\/span><\/p>\n

There is also evidence that FIN7 is employing search engine optimization (SEO) to keep users engaged and to rank their honeypots higher in search results by using footer links to “Best Porn Sites” on its sites. Those links direct victims to other malicious sites dangling the same lure.<\/span><\/p>\n

Moreover, the group invested effort in creating two website versions for promoting the deepfake tool. The first involves a DeepNude Generator “free download,” and the second offers site visitors a DeepNude Generator “free trial,” each with a different attack flow.  <\/span><\/p>\n

Related:<\/span>Dragos Expands ICS Platform With New Acquisition<\/a><\/p>\n

The first uses “a simple user flow” that uses a “free download” link leading users to a new domain featuring a Dropbox link or another source hosting a malicious payload, according to Silent Push.<\/span><\/p>\n

The second attack flow prompts users via a “free trial” button to upload an image to test the generator. If this is done, the user is next prompted with a \u201ctrial is ready for download\u201d message, with a corresponding pop-up requires the user to answer the question: “The link is for personal use only, do you agree?”<\/span><\/p>\n

“If the user agrees and clicks ‘download,’ they are served a .zip file with a malicious payload” that leads to the <\/span>Lumma Stealer<\/a><\/span>, and which uses a DLL side-loading technique for execution, according to Silent Push.<\/span><\/p>\n

Mitigation & Defense Against Fin7<\/h2>\n

The two campaigns demonstrate that FIN7 \u2014 a cybercrime collective also known as Carbanak, Carbon Spider, Cobalt Group, and Navigator Group that’s been active since 2012 \u2014 remains an imminent threat despite <\/span>many attempts by law enforcement<\/a><\/span> to <\/span>shut it down<\/a><\/span>, or at least significantly disrupt it. It also shows a tenacity on the group’s part to evolve with modern technology and psychological tactics to create more sophisticated ways to spread malware, the researchers said.<\/span><\/p>\n

Related:<\/span>Millions of Kia Vehicles Open to Remote Hacks via License Plate<\/a><\/p>\n

Indeed, FIN7 has long been known for its savvy combination of malware and social engineering, having mounted a slew of successful, <\/span>financially motivated attacks<\/a><\/span> against global organizations that have hauled in well over $1.2 billion \u2014 and counting \u2014 for the criminal enterprise.<\/span><\/p>\n

To help organizations combat threats from FIN7 and other organized cybercriminal groups, developing indicators of attack based on the group’s tactics, techniques, and procedures (TTPs) is one method. Also, training employees to be aware of these increasingly elaborate social engineering tactics that threat groups use, and blocking the download of any unknown any files from the Internet onto a machine connected to a corporate network also can help enterprises avoid compromise by sophisticated threat campaigns.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The notorious FIN7 threat group is combining artificial intelligence (AI)<\/p>\n","protected":false},"author":12,"featured_media":5618,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-5617","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=1920%2C1080&ssl=1",1920,1080,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=1920%2C1080&ssl=1",1920,1080,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/ai-nude-photo-generator-delivers-infostealers-instead-of-images.png?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5617"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5617\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/5618"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}