Remove 2008 Remove Encryption Remove Information Security Remove Malware
article thumbnail

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service called SocksEscort , which rents hacked residential and small business devices to cybercriminals looking to hide their true location online. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies.

Malware 203
article thumbnail

Avast released a free decryptor for the Windows version of the Akira ransomware

Security Affairs

In June 2023, the malware analyst rivitna published a sample of the ransomware that is compiled for Linux. “During the run, the ransomware generates a symmetric encryption key using CryptGenRandom() , which is the random number generator implemented by Windows CryptoAPI. . Files are encrypted by Chacha 2008 ( D.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Microsoft recommends Exchange admins to disable the SMBv1 protocol

Security Affairs

Microsoft is recommending administrators to disable the SMBv1 network communication protocol on Exchange servers to prevent malware attacks. Microsoft is urging administrators to disable the SMBv1 protocol on Exchange servers as a countermeasure against malware threats like TrickBot and Emotet. Get-WindowsFeature FS-SMB1).Installed

article thumbnail

A deeper insight into the CloudWizard APT’s activity revealed a long-running activity

Security Affairs

In October 2022, Kaspersky researchers uncovered a malware campaign aimed at infecting government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions with a previously undetected framework dubbed CommonMagic. This means that the threat actor was able to avoid detection for more than 15 years.

Malware 77
article thumbnail

Law enforcement shutdown the VPN service VPNLab used by many cybercriminal gangs

Security Affairs

VPNLab was launched in 2008 and was offering online anonymity to criminal organizations. Its technology was based on OpenVPN and adopted 2048-bit encryption, the price for the subscription was very low, just $60/year. The authorities seized 15 VPNLab.net servers across 10 countries.

VPN 82
article thumbnail

PurpleFox botnet variant uses WebSockets for more secure C2 communication

Security Affairs

” The MSI package first removes registry keys associated with the old Purple Fox installations if any are present, then it replaces the components of the malware with new ones. “The goal is to install the MSI package as an admin without any user interaction.” ” continues the analysis.

article thumbnail

Qbot uses a new email collector module in the latest campaign

Security Affairs

QBot, aka Qakbot and Pinkslipbot , has been active since 2008, it is used by malware for collecting browsing data and banking credentials and other financial information from the victims. The attackers could hijack the email threads to propagate the malware.

Banking 107