Five years is a long time for a botnet to remain undetected, which may be why security experts said that the recently uncovered Stantinko malware may have infected more than half a million PCs so far.

Cybercriminals Commandeer Pirated Software

Researchers at ESET first reported details of the modular Trojan with advanced backdoor capabilities, dubbed Stantinko, in a blog post on We Live Security. Targeting users of pirated software primarily in Russia and Ukraine, the malware installs a variety of programs on victims’ machines using an app called FileTour. Once live, the botnet can earn money through click fraud and ad injection while potentially leaving machines vulnerable to other forms of attack.

According to SecurityWeek, Stantinko’s strength comes in part through the use of Teddy Protection and The Safe Surfing, a pair of extensions for the Chrome browser that can run adware campaigns.

The threat is more ingenious in its use of malicious Windows services that act as a sort of tag team. The botnet installs two such malicious services, which can be used to strike WordPress or Joomla admin controls and spy on search histories.

The worst part? Deleting one will cause the other to simply re-install it. Cybercriminals can essentially commandeer an infected PC with a plug-in system flexible enough to execute any code.

Sneaky Stantinko Seeks Shelter

So how was something this dangerous able to evade antivirus protection tools since 2012, you ask? Just as Stantinko sneaks onto a system while FileTour loads other apps, Silicon explained, the malicious code takes shelter in one of two places. This includes the Windows registry of the disk, which means that until malicious commands are executed, they are more or less invisible from most standard monitoring products.

To some extent, Stantinko might not seem like a major threat, since its focus was on a limited geographic area. Furthermore, it emphasized adware and click fraud rather than stealing and selling users’ personal information.

As Bleeping Computer pointed out, though, this botnet is still very much alive. The privacy of victims is still being violated, and the sophisticated design is available for other cybercriminals to study. Let’s hope they aren’t inspired to make similar malware and use some of its more serious capabilities.