Threat Management, Incident Response, Malware, Network Security, Patch/Configuration Management, TDR, Vulnerability Management

Researchers patrolling dark web uncover trojan plot targeting web hosting service

Web hosting provider Invision Power Services (IPS) this month was saved from a systems compromise that could have potentially damaged its clients, after researchers gathered intelligence on a cybercriminal plot that was unfolding on the dark web.

The scheme was spearheaded by a bad actor dubbed AlphaLeon, who is also known to have sold the recently discovered trojan Thanatos, aka Alphabot, on the online black market. According to a new report from SurfWatch Labs, one of AlphaLeon's latest schemes was compromising IPS via an unpatched software vulnerability. Had the adversary's campaign gone undetected, IPS could have secondarily compromised its client base, which includes some professional sports leagues and media and entertainment companies.

Upon being notified, Forest, Va.-based IPS confirmed via a penetration test that a malicious hacker had, indeed, infiltrated the company's managed hosting environment, which is operated via Amazon Web Services. Such unauthorized root-level access would have allowed the hackers to install exploit kits that could have infected users visiting IPS' hosted sites with malware capable of stealing bank credentials and bitcoins, delivering ransomware, launching distributed denial of service (DDoS) attacks and more.

Fortunately, SurfWatch threat intelligence analysts appear to have caught the campaign before it was launched. Adam Meyer, chief security strategist at SurfWatch Labs, said that his team of researchers is able to detect dark web threats such as this one through a combination of automated scanning and human investigation. “We also have built a quantity of undercover personalities,” Meyer told, “and we use those personalities to get into areas where we can observe the back-room conversations” where cybercriminals wheel and deal.

SurfWatch would not name IPS's clients, nor did the company identify the specific software vulnerability that was exploited.'s call to IPS for further comment went unanswered.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.