This report investigates the Adwind malware-as-a-service platform and its targeted attacks. Adwind is a cross-platform RAT (Remote Access Trojan) that has been in circulation since 2011. The malware is distributed through various means, including phishing emails and malicious websites. The report also discusses several other RATs that are related to Adwind, including Frutas, UNRECOM, and AlienSpy. The latest version of Adwind, JSocket.org, is described in detail, as well as its associated online malware shop and YouTube channel. The report concludes by discussing the profitability of Adwind and its latest known attacks.
