{"id":37507,"date":"2022-10-26T12:48:30","date_gmt":"2022-10-26T09:48:30","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=37507"},"modified":"2026-03-28T02:03:42","modified_gmt":"2026-03-27T23:03:42","slug":"advancedipspyware-an-unusual-signed-backdoored-tool-targets-organizations-worldwide","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/advancedipspyware-an-unusual-signed-backdoored-tool-targets-organizations-worldwide\/","title":{"rendered":"AdvancedIPSpyware, an unusual signed backdoored tool, targets organizations worldwide"},"content":{"rendered":"\n

In a recent crimeware report, Kaspersky experts have described AdvancedIPSpyware. It is a backdoored version of <\/a><\/strong>legitimate Advanced IP Scanner tool used by network admins to control local area networks (LANs).<\/strong> The malicious tool affected <\/strong>a broad audience with victims in Latin America, Africa, Western Europe, South Asia, Australia as well as CIS countries.<\/a><\/strong><\/strong><\/p>\n\n\n\n

Adding malicious code to benign software in order to hide its harmful activity and trick the user is a technique that has become increasingly common. <\/a>What hasn\u2019t been seen as often is that the backdoored binary is actually signed. This is precisely the case of AdvancedIPSpyware, which is a backdoored version of legitimate Advanced IP Scanner tool used by network admins to control LANs. The certificate with which the malware was signed was most likely stolen. The malware was hosted on two sites, whose domains are almost identical to the legitimate Advanced IP Scanner website, differing only by one the letter. Furthermore, the websites look the same. The only difference is the \u201cfree download\u201d button on the malicious websites. <\/p>\n\n\n\n

\"https:\/\/lh4.googleusercontent.com\/xEy1dfPBQY_dMvNE5YfkD1YSRb3ja9kUCOIyyF23oND4p5hXxQF79_UpNy7K392hSwj1Mt2Hk41JqeLWfFB4ULNs3gJ0H7oW-goryZWO5IueILvAGo109unhf4umpiEo63oBNK66E1WSRd8Opm9FvpWrQvHuBna95CORtd6ux6ITrp2uZXbzsEOgWw\"\/<\/figure>\n\n\n\n

The legitimate signed binary vs the malicious signed binary<\/em><\/p>\n\n\n\n

Another uncommon feature of AdvancedIPSpyware is that the architecture is modular. Typically, modular architecture is seen with nation-state sponsored malware, not with the criminal type. However, in this case the attacks were not targeted, that drives at the conclusion that AdvancedIPSpyware does not refer to any politically motivated campaigns.<\/p>\n\n\n\n

The AdvancedIPSpyware campaign has a broad victimology with affected users in Latin America, Africa, Western Europe, South Asia, Australia as well as CIS countries. The overall count of victims infected over the whole course of the campaign is about 80.<\/p>\n\n\n\n

Besides AdvancedIPSpyware, the crimeware report published on Securelist includes the following findings:<\/p>\n\n\n\n