FIN7 hackers launch deepfake nude “generator” websites to unfold malware

The infamous APT hacking group often called FIN7 has launched a community of pretend AI-powered deepnude generator websites to contaminate guests with information-stealing malware.

FIN7 is believed to be a Russian hacking group that has been conducting monetary fraud and cybercrime since 2013, with ties to ransomware gangs, resembling DarkSide, BlackMatter, and BlackCat, who just lately carried out an exit rip-off after stealing a $20 million UnitedHealth ransom cost.

FIN7 is thought for its subtle phishing and social engineering assaults, resembling impersonating BestBuy to ship malicious USB keys or making a faux safety firm to rent pentesters and builders for ransomware assaults with out them understanding.

So it is not stunning to search out that they’ve now been linked to an intricate community of internet sites selling AI-powered deepnude turbines that declare to create faux nude variations of pictures of clothed people.

The expertise has been controversial as a result of hurt it may possibly trigger to the themes by creating non-consensual specific photographs, and it has even been outlawed in lots of locations on this planet. Nevertheless, the curiosity on this expertise stays robust.

A community of deepnude turbines

FIN7’s faux deepnude websites function honeypots for folks thinking about producing deepfake nudes of celebrities or different folks.  In 2019, menace actors used an identical lure to unfold info-stealing malware even earlier than the AI explosion.

The community of deepnude turbines operates below the identical “AI Nude” model and is promoted by way of black hat web optimization techniques to rank the websites excessive in search outcomes.

In keeping with Silent Push, FIN7 instantly operated websites like “aiNude[.]ai”, “easynude[.]web site”, and nude-ai[.]professional,” which provided “free trials” or “free downloads,” however in actuality simply unfold malware.

All of the websites use an identical design that guarantees the power to generate free AI deepnude photographs from any uploaded picture.

The faux web sites enable customers to add pictures that they want to create deepfake nudes. Nevertheless, after the alleged “deepnude” is made, it isn’t displayed on the display screen. As an alternative, the person is prompted to click on a hyperlink to obtain the generated picture.

Doing so will deliver the person to a different web site that shows a password and a hyperlink for a password-protected archive hosted on Dropbox. Whereas this web site remains to be alive, the Dropbox hyperlink not works.

Nevertheless, as an alternative of a deepnude picture, the archive archive incorporates the Lumma Stealer information-stealing malware. When executed, the malware will steal credentials and cookies saved in internet browsers, cryptocurrency wallets, and different knowledge from the pc.

Silent Push additionally noticed some websites selling a deepnude technology program for Home windows that may as an alternative deploy Redline Stealer and D3F@ck Loader, that are additionally used to steal data from compromised units.

All seven websites detected by Silent Push have since been taken down, however customers who might need downloaded information from them ought to take into account themselves contaminated.

Different FIN7 campaigns

Silent Push additionally recognized parallel FIN7 campaigns dropping NetSupport RAT by way of web sites that immediate guests to put in a browser extension.

In different instances, FIN7 makes use of payloads that seem to spoof well-known manufacturers and functions resembling Cannon, Zoom, Fortnite, Fortinet VPN, Razer Gaming, and PuTTY.

These payloads could also be distributed to victims utilizing web optimization techniques and malvertising, tricking them into downloading trojanized installers.

FIN7 was just lately uncovered for promoting its customized “AvNeutralizer” EDR killing instrument to different cybercriminals, concentrating on IT workers of automotive makers in phishing assaults, and deploying Cl0p ransomware in assaults towards organizations.