Typically, such a modular architecture is found in malware whose developers are state-sponsored actors. The only difference is the 'free download' button on the malicious websites.ĪdvancedIPSpyware is modular.

The malware was hosted on two websites whose domains are almost identical to the legitimate Advanced IP Scanner website, differing only by one letter otherwise the pages look the same. The certificate used to sign the malware was most likely stolen previously. More rarely, the backdoor binary is actually signed, as is the case with AdvancedIPSpyware. Software infected with malware Advanced IP ScannerĬyber criminals are increasingly inserting malicious code into legitimate software to hide their malicious activities. The total number of victims infected throughout the campaign is already around 80. The AdvancedIPSyware campaign has a wide victimology with affected companies in Western Europe, Latin America, Africa, South Asia, Australia and CIS countries. This is a backdoor version of the legitimate Advanced IP Scanner tool used by network administrators to control local area networks (LANs). Kaspersky experts have discovered a new spyware called AdvancedIPSyware.

Kaspersky experts have investigated the campaign. The AdvancedIPSpyware: Backdoor version of the Advanced IP Scanner also spies on companies in Western Europe. The legitimate tool Advanced IP Scanner, popular among network administrators, has emerged as a malware-infested version.

Advanced ip