Remove 2010 Remove Antivirus Remove Malware Remove Passwords
article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. This story explores the history and identity behind Cryptor[.]biz WHO RUNS CRYPTOR[.]BIZ?

Malware 216
article thumbnail

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Krebs on Security

This post is a deep dive on “ Megatraffer ,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015. “Antivirus software trusts signed programs more. One of Megatraffer’s ads on an English-language cybercrime forum. ru in 2008.

Malware 238
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

U.S., U.K. Sanction 7 Men Tied to Trickbot Hacking Group

Krebs on Security

Initially a stealthy trojan horse program delivered via email and used to steal passwords, Trickbot evolved into “a highly modular malware suite that provides the Trickbot Group with the ability to conduct a variety of illegal cyber activities, including ransomware attacks,” the Treasury Department said. .”

Hacking 190
article thumbnail

MartyMcFly Malware: new Cyber-Espionage Campaign targeting Italian Naval Industry

Security Affairs

Yoroi security firm uncovered a targeted attack against one of the most important companies in the Italian Naval Industry leveraging MartyMcFly Malware. How Microsoft Excel is able to decrypt such a content if no password is requested to the end user? And why the attacker used an encrypted payload if the victim cannot open it?

Malware 93
article thumbnail

Tracing the Supply Chain Attack on Android

Krebs on Security

” What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware. com — were implicated in propagating the Triada malware. net 2010-11-22 ALIBABA CLOUD COMPUTING (BEIJING) CO., “Yehuo” ( ? ? ) com , buydudu[.]com

Mobile 245
article thumbnail

Crooks leverages.htaccess injector on Joomla and WordPress sites for malicious redirects

Security Affairs

The website was used by attackers to redirect traffic to advertising sites that attempted to deliver malware. The features include the redirect functionality, content password protection or image hot link prevention. Researchers at Sucuri are warning Joomla and WordPress websites admins of malicious hypertext access (.htaccess)

article thumbnail

Tracing the Supply Chain Attack on Android

Krebs on Security

” What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware. com — were implicated in propagating the Triada malware. net 2010-11-22 ALIBABA CLOUD COMPUTING (BEIJING) CO., “Yehuo” ( ? ? ) com , buydudu[.]com

Mobile 161