article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. This story explores the history and identity behind Cryptor[.]biz WHO RUNS CRYPTOR[.]BIZ?

Malware 212
article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

This post is a deep dive on “ Megatraffer ,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015. “Antivirus software trusts signed programs more. ru in 2008. su from 2008. su from 2008. 2016 sales thread on Exploit.

Malware 234
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

When Your Smart ID Card Reader Comes With Malware

Krebs on Security

Out of an abundance of caution, Mark submitted Saicoo’s drivers file to Virustotal.com , which simultaneously scans any shared files with more than five dozen antivirus and security products. He said Saicoo did not address his concern that the driver package on its website was bundled with malware.

Malware 335
article thumbnail

Purple Lambert, a new malware of CIA-linked Lambert APT group

Security Affairs

Cybersecurity firm Kaspersky discovered a new strain of malware that is believed to be part of the arsenal of theUS Central Intelligence Agency (CIA). Cybersecurity firm Kaspersky has discovered a new malware that experts attribute to the US Central Intelligence Agency. We therefore named this malware Purple Lambert.”

Malware 106
article thumbnail

StripedFly: Perennially flying under the radar

SecureList

Introduction It’s just another cryptocurrency miner… Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. This malware employed a custom EternalBlue SMBv1 exploit to infiltrate its victims’ systems.

Malware 107
article thumbnail

WinDealer dealing on the side

SecureList

LuoYu is a lesser-known threat actor that has been active since 2008. In their initial disclosures on this threat actor, TeamT5 identified three malware families: SpyDealer, Demsty and WinDealer. Leaving the mystery of the delivery method aside for now, let’s look at the capabilities of the malware itself.

Malware 113
article thumbnail

Types of Malware & Best Malware Protection Practices

eSecurity Planet

Malware, short for “malicious software,” is any unwanted software on your computer that, more often than not, is designed to inflict damage. Since the early days of computing, a wide range of malware types with varying functions have emerged. Best Practices to Defend Against Malware. Jump ahead: Adware. RAM scraper.

Malware 105