{
  "family": "fakerean",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Rogue:Win32/Fakerean is a highly deceptive piece of malware classified as **Fake Antivirus (FakeAV) or Scareware**. Its entire operational model relies on social engineering and intimidation. It masquerades as a legitimate Windows security scanner, bombarding the user with fabricated alerts of catastrophic malware infections to coerce them into paying for a useless 'premium' license to clean their system.<br><br><b>Understanding Fakerean (Scareware)</b><br>To an end-user, Fakerean is terrifying. It employs aggressive pop-ups, flashes red warning banners across the screen, and mimics the UI of real security tools (like Windows Defender) to convince the user their machine is hopelessly compromised. For an enterprise security team, Fakerean is a nuisance malware that exploits human psychology rather than sophisticated zero-day vulnerabilities. It degrades productivity and represents a successful phishing or malvertising attack.<br><br><b>Execution and Intimidation Mechanics</b><br>Fakerean is primarily distributed via drive-by downloads on compromised websites, malicious advertising networks (malvertising), or fake 'Flash Player update' lures (`T1189`, `T1204.002`). Upon execution, it establishes persistence via the Registry Run keys to ensure it launches automatically upon boot (`T1547.001`). To enforce the illusion of an infected system and force payment, Fakerean actively impairs the user's ability to fix the problem. It modifies registry policies to disable Task Manager (`taskmgr.exe`), the Registry Editor (`regedit.exe`), and often blocks the execution of real, legitimate antivirus software by terminating their processes (`T1562.001`). It then displays a full-screen, unclosable window demanding credit card payment to 'remove the 42 detected severe threats' (`T1491.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (if the user pays) and total loss of productivity. Host-based IoCs are blatantly obvious: highly aggressive, non-standard 'antivirus' pop-ups, the inability to launch administrative tools, and EDR alerts for rapid registry modifications aimed at disabling system policies. Network IoCs include HTTP traffic to the rogue payment gateways.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Fakerean and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakerean is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fakerean establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakerean typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Fakerean compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Fakerean should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Fakerean leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakerean frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fakerean maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakerean often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1491.001",
    "T1204.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement (Aggressive fake AV UI)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blocking Task Manager/AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately boot the infected machine into 'Safe Mode' to prevent the Fakerean executable from launching and blocking remediation tools.",
    "Use offline scanners or a reputable enterprise EDR tool (while in Safe Mode) to identify and delete the Fakerean binary and its registry persistence keys.",
    "Use a tool like `gpupdate /force` or manually edit the registry to reverse the policies that disabled Task Manager and Regedit.",
    "If the user submitted payment, advise them to immediately contact their credit card provider to report the fraudulent transaction."
  ],
  "what_to_avoid": [
    "Do not allow users to input payment information; paying the ransom will not clean the machine and exposes financial data to criminals.",
    "Avoid trying to manually kill the process from the normal desktop environment, as Fakerean often actively monitors and blocks `taskkill` commands."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}