Privacy Ninja

MyKings Botnet Still Active And Making Massive Amounts Of Money

MyKings Botnet Still Active And Making Massive Amounts Of Money

The MyKings botnet (aka Smominru or DarkCloud) is still actively spreading, making massive amounts of money in crypto, five years after it first appeared in the wild.

Being one of the most analyzed botnets in recent history, MyKings is particularly interesting to researchers thanks to its vast infrastructure and versatile features, including bootkits, miners, droppers, clipboard stealers, and more.

The latest team of researchers to look into MyKings is Avast Threat Labs, which gathered 6,700 unique samples to analyze since the beginning of 2020.

During the same period, Avast actively prevented over 144,000 attacks MyKings against its clients, most of them based in Russia, India, and Pakistan.

Also Read: Intrusion Into Privacy All About Law And Legal Definition

Victims heat map
Victims heat map
Source: Avast

The botnet uses many cryptocurrency wallet addresses, with the balances in some of them being quite high. Avast believes that these wallets’ cryptocurrency was amassed by the clipboard stealer and the crypto mining components.

The earnings reflected in the wallet addresses linked to MyKings are approximately $24.7 million. However, since the botnet uses more than 20 cryptocurrencies in total, this amount is only a part of its total financial gains.

Earnings concerning three cryptocurrencies
Earnings concerning three cryptocurrencies
Source: Avast

To protect the hardcoded wallet address value from extraction and analysis, the malware encrypts it with a simple ROT cipher. In general, though, no notable upgrades have been spotted on that front in the recent samples.

New URL substitution tricks

Apart from the wallet address substitution that diverts transactions, Avast has also spotted a new monetization technique used by MyKings operators involving the Steam gaming platform.

Victimized Steam users complaining about the trade link changes
Victimized Steam users complaining about the trade link changes
Source: Avast

The latest versions of the malware also feature a new URL manipulation system in the clipboard stealer module, which the attackers created to hijack Steam item trade transactions. The module changes the trade offer URL, so the actor is placed at the receiving end, stealing valuable in-game items, etc.

Similar functionality was added for the Yandex disk storage cloud service, with MyKing manipulating the URLs sent by users to their acquaintances.

Also Read: New Data Protection Laws Australia: How Implementation Works

The modified links point to Yandex storage addresses containing RAR or ZIP archives named “photos,” which deliver a copy of the MyKings malware to these machines.

Fake 'photos' archive delivering malware
Fake ‘photos’ archive delivering malware
Source: Avast

In 2018, MyKings was growing steadily, with the malware reaching 520,000 infections and making millions of dollars for its operators. 

Today, it appears that the botnet has grown to new proportions while still managing to remain hidden and free from law enforcement crackdowns.

Outsourced Data Protection Officer – It is mandatory to appoint a Data Protection Officer. We help our clients quickly comply with their PDPA & data protection requirements.

Vulnerability Assessment Penetration Testing – Find loopholes in your websites, mobile apps or systems.

Smart Contract Audit – Leverage our industry-leading suite of blockchain security analysis tools, combined with hands-on review from our veteran smart contract auditors.


Leave a Reply

Your email address will not be published. Required fields are marked *


Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.

Powered by WhatsApp Chat

× Chat with us