article thumbnail

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

Krebs on Security

“If you need a server for a botnet, for malware, brute, scan, phishing, fakes and any other tasks, please contact us,” BEARHOST’s ad on one forum advises. A fake browser update page pushing mobile malware. And BEARHOST has been cultivating its reputation since at least 2019. Image: Intrinsec.

Malware 271
article thumbnail

An Interview With the Target & Home Depot Hacker

Krebs on Security

Shefel asserts he and his team were responsible for developing the card-stealing malware that Golubov’s hackers installed on Target and Home Depot payment terminals, and that at the time he was technical director of a long-running Russian cybercrime community called Lampeduza. ” Dmitri Golubov, circa 2005. . Image: U.S.

Retail 283
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

This post is a deep dive on “ Megatraffer ,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015. More recently, it appears Megatraffer has been working with ransomware groups to help improve the stealth of their malware. WHO IS MEGATRAFFER?

Malware 321
article thumbnail

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service called SocksEscort , which rents hacked residential and small business devices to cybercriminals looking to hide their true location online. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies.

Malware 245
article thumbnail

The Link Between AWM Proxy & the Glupteba Botnet

Krebs on Security

On December 7, 2021, Google announced it was suing two Russian men allegedly responsible for operating the Glupteba botnet, a global malware menace that has infected millions of computers over the past decade. PPI programs) to generate new installations of their malware.” And maybe that was the point. and starovikov[.]com.

Passwords 329
article thumbnail

Meet the Administrators of the RSOCKS Proxy Botnet

Krebs on Security

Stanx said he was a longtime member of several major forums, including the Russian hacker forum Antichat (since 2005), and the Russian crime forum Exploit (since April 2013). In an early post to Antichat in January 2005, Stanx disclosed that he is from Omsk , a large city in the Siberian region of Russia.

article thumbnail

Diavol Ransomware Appears to Have Connections with TrickBot

Heimadal Security

TrickBot is a distant descendent of the ZeuS banking Trojan, which first appeared in 2005, although it is most commonly associated with Dyre or Dyreza, which went down in 2015. TrickBot appeared in 2016, replicating parts of Dyre’s malware while preserving its banking credential harvesting and web inject architecture.