Your Botnet Is His Botnet? A Deep Dive Into the Supply Chain Attack Against Cyber-Arm Industry

In recent years, supply chain attacks have garnered significant attention from both enterprises and the security community due to their profound impact. Numerous studies have begun to focus on supply chain attacks targeting legitimate software. However, it is noteworthy that supply chain attacks also occur within cybercrime markets, which differ substantially from those observed in lawful markets. These attacks not only facilitate widespread infections but also enable the rapid formation of substantial botnets. Regrettably, supply chain attacks within cybercrime markets have largely been overlooked by the security community, resulting in a notable deficiency in systematic methodologies for comprehending such assaults. This work concentrates on a specific supply chain attack observed in cybercrime markets, denoted as the “Nigrita Attack.” To facilitate a systematic understanding of this attack, we introduce a model designed to delineate its propagation dynamics. Additionally, we propose an approach for forecasting its future threat potential. To assess the efficacy of the proposed propagation model and the accuracy of the method for predicting the scale of infections, we assembled a dataset comprising more than 40,342 distinct malware samples and conducted a comprehensive series of analyses. Empirical results substantiate both the effectiveness of the proposed propagation model and the precision of the approach in estimating the magnitude of potential infections.