“Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing and malware distribution campaigns and money mule schemes. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI), is releasing this Technical Alert to provide further information about Avalanche.

Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers.

In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise.

Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.

The following malware families were hosted on the infrastructure:

Windows-encryption Trojan horse (WVT) (aka Matsnu, Injector,Rannoh,Ransomlock.P)

URLzone (aka Bebloh)

Citadel

VM-ZeuS (aka KINS)

Bugat (aka Feodo, Geodo, Cridex, Dridex, Emotet)

newGOZ (aka GameOverZeuS)

Tinba (aka TinyBanker)

Nymaim/GozNym

Vawtrak (aka Neverquest)

Marcher

Pandabanker

Ranbyus

Smart App

TeslaCrypt

iBanking Trusteer App Trojan

Xswkit

Avalanche was also used as a fast flux botnet which provides communication infrastructure for other botnets, including the following: