Hackers Manipulated Ratings of Pro-Russian Videos

Hacktivists and/or cybercrooks compromised the computers of victims to invisibly load propaganda videos and ads, upping the click-views, and thus the popularity, of the party line promos and commercial products.

The videos identified in research by security firm Trustwave all appear to be pro-Russian, such as this one from Iranian English-language broadcaster PressTV that quotes a Russian Parliament member justifying the annexation of Crimea. The goal of the operation apparently was to artificially inflate the status of a video and make it more visible to users of the site Dailymotion. 

Victim computers became infected when visiting a compromised site that surreptitiously installed viruses.

The malware loaded videos in a hidden desktop, so that victims weren’t even aware they were viewing clips. Their computers also were rigged to browse sites filled with ads, likely in an attempt to create revenue for the criminals behind this operation. 

“We have seen hacks that are motivated by money and other 'hacktivist' attacks that are motivated by politics,” said Karl Sigler, the threat intelligence manager at Trustwave. “This current campaign shows that those two motivations are starting to evolve and blend together.”

It is possible the criminals who spread the malware only aspired to make a buck, while someone else paid them to inflate views on the propaganda videos. 

“The researchers found out that these videos had fake views because they all had a very similar, high (more than 300,000 at the time they checked), number of views but zero social media shares. Furthermore, a large number of views seemed to all come at the same time, according to the video’s statistics,” Motherboard reports.