Remove 2008 Remove Encryption Remove Malware
article thumbnail

PLAYFULGHOST backdoor supports multiple information stealing features

Security Affairs

PLAYFULGHOST is a new malware family with capabilities including keylogging, screen and audio capture, remote shell access, and file transfer/execution. The PLAYFULGHOST backdoor shares functionality with Gh0stRAT whose source code was publicly released in 2008. ” reads the report published by Google.

Malware 132
article thumbnail

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service called SocksEscort , which rents hacked residential and small business devices to cybercriminals looking to hide their true location online. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies.

Malware 244
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware

Krebs on Security

But new analysis suggests that while Eternal Blue could have been used to spread the infection, the Robbinhood malware itself contains no traces of it. Stewart said he obtained a sample of the malware that he was able to confirm was connected to the Baltimore incident. National Security Agency (NSA) and leaked online in 2017.

article thumbnail

IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia

SecureList

Day after day, threat actors create new malware to use in cyberattacks. Each of these new implants is developed in its own way, and as a result gets its own destiny while the use of some malware families is reported for decades, information about others disappears after days, months or several years.

Malware 91
article thumbnail

Microsoft recommends Exchange admins to disable the SMBv1 protocol

Security Affairs

Microsoft is recommending administrators to disable the SMBv1 network communication protocol on Exchange servers to prevent malware attacks. Microsoft is urging administrators to disable the SMBv1 protocol on Exchange servers as a countermeasure against malware threats like TrickBot and Emotet. Get-WindowsFeature FS-SMB1).Installed

article thumbnail

Patch Tuesday, December 2019 Edition

Krebs on Security

The patches include fixes for seven critical bugs — those that can be exploited by malware or miscreants to take control over a Windows system with no help from users — as well as another flaw in most versions of Windows that is already being exploited in active attacks.

Backups 190
article thumbnail

Andariel evolves to target South Korea with ransomware

SecureList

Our attribution is based on the code overlaps between the second stage payload in this campaign and previous malware from the Andariel group. This second stage malware decrypts the embedded payload at runtime. XOR key and encrypted payload. XOR key and encrypted payload. Drive path to encrypt. #2. 8877 Success!