Some of the malvertising sites observed by Darktrace on customer deployments were crackful[.]com, modcrack[.]net, windows-7-activator[.]com and office-activator[.]com. However, in many cases detected by Darktrace, CryptBot was propagated via websites offering trojanized KMSPico software (e.g., official-kmspico[.]com, kmspicoofficial[.]com). KMSPico is a popular Microsoft Windows and Office product activator that emulates a Windows Key Management Services (KMS) server to activate licenses fraudulently.
Technically speaking, there are several so-called activators: KMSActivator, KMSAuto and KMSpico. They are used to activate the Windows operating system. These programs work in such a way that they bypass the standard activation process, which usually involves connecting a specific computer to Microsoft servers. These hacktools create an emulated key management service (KMS) server in the local network, and then redirect the installation to this server to bypass the license lock of the Office system or Office suite.