Remove 2022 Remove Antivirus Remove Blog Remove Cybercrime
article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

One of Megatraffer’s ads on an English-language cybercrime forum. “Antivirus software trusts signed programs more. The email address akafitis@gmail.com was used to create a Livejournal blog profile named Fitis that has a large bear as its avatar. “Why do I need a certificate?” account on Carder[.]su

Malware 252
article thumbnail

A cracked copy of Brute Ratel post-exploitation tool leaked on hacking forums

Security Affairs

The Brute Ratel post-exploitation toolkit has been cracked and now is available in the underground hacking and cybercrime communities. Threat actors have cracked the Brute Ratel C4 (BRC4) post-exploitation toolkit and leaked it for free in the cybercrime underground. On 13 September 2022, an archive file called “bruteratel_1.2.2.Scandinavian_Defense.tar.gz”

Hacking 102
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Ten Years Later, New Clues in the Target Breach

Krebs on Security

That reporting was based on clues from an early Russian cybercrime forum in which a hacker named Rescator — using the same profile image that Rescator was known to use on other forums — claimed to have originally been known as “Helkern,” the nickname chosen by the administrator of a cybercrime forum called Darklife.

article thumbnail

BlackCat Ransomware gang breached over 60 orgs worldwide

Security Affairs

ALPHV has been advertising the BlackCat Ransomware-as-a-Service (RaaS) on the cybercrime forums XSS and Exploit since early December. The alert includes indicators of compromise (IoCs) associated with BlackCat/ALPHV, as of mid-February 2022. Review antivirus logs for indications they were unexpectedly turned off.

article thumbnail

Malicious apps continue to spread through the Google Play Store

Security Affairs

Researchers at antivirus firm Dr. Web discovered malware in the Google Play Store that was downloaded two million times. An investigation conducted by the antivirus firm Dr. Web in May resulted in the discovery of multiple adware and information-stealing malware on the official Google Play Store. To nominate, please visit:?.

Adware 87
article thumbnail

SharkBot Banking Trojan spreads through fake AV apps on Google Play

Security Affairs

Experts discovered malicious Android apps on the Google Play Store masqueraded as antivirus solutions spreading the SharkBot Trojan. One of the SharkBot’s features detailed by the experts is its ability to auto reply to notifications from Facebook Messenger and WhatsApp to spread links to the fake antivirus apps.

Banking 88
article thumbnail

An expert shows how to stop popular ransomware samples via DLL hijacking

Security Affairs

Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as theres nothing to kill the DLL just lives on disk waiting. The exploit dll will check if the current directory is “C:WindowsSystem32″, if not we grab our process ID and terminate. To nominate, please visit:?