article thumbnail

XDSpy APT remained undetected since at least 2011

Security Affairs

Researchers from ESET uncovered the activity of a new APT group, tracked as XDSpy, that has been active since at least 2011. XDSpy is the name used by ESET researchers to track a nation-state actor that has been active since at least 2011. SecurityAffairs – hacking, XDSpy). ” reads the abstract from the talk.

Malware 136
article thumbnail

The Link Between AWM Proxy & the Glupteba Botnet

Krebs on Security

That same day, AWM Proxy — a 14-year-old anonymity service that rents hacked PCs to cybercriminals — suddenly went offline. AWMproxy, the storefront for renting access to infected PCs, circa 2011. Over the past decade, both Glupteba and AWM Proxy have grown substantially. But on Dec.

Passwords 236
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

SHARED INTEL: How ransomware evolved from consumer trickery to deep enterprise hacks

The Last Watchdog

The above-mentioned AIDS Trojan hailing from the distant pre-Internet era was the progenitor of the trend, but its real-world impact was close to zero. In many cases, the crooks hack managed service providers (MSPs) first and then use this access to compromise the partnering organizations.

article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

has been associated with the user Kerens on the Russian hacking forum Exploit from 2011 to the present day. The very first post by Kerens on Exploit in 2011 was a negative review of a popular crypting service that predated Cryptor[.]biz .” Meanwhile, the Jabber address masscrypt@exploit.im

Malware 213
article thumbnail

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

Kilmer said Faceless has emerged as one of the underground’s most reliable malware-based proxy services, mainly because its proxy network has traditionally included a great many compromised “Internet of Things” devices — such as media sharing servers — that are seldom included on malware or spam block lists.

Malware 228
article thumbnail

Confessions of an ID Theft Kingpin, Part I

Krebs on Security

For several years beginning around 2010, a lone teenager in Vietnam named Hieu Minh Ngo ran one of the Internet’s most profitable and popular services for selling “ fullz ,” stolen identity records that included a consumer’s name, date of birth, Social Security number and email and physical address. BEGINNINGS.

article thumbnail

More than 3,000 Openfire servers exposed to attacks using a new exploit

Security Affairs

Any version released before then is not vulnerable, and these older versions make up nearly 25% of the internet-facing Openfire servers. released in 2011.” ” “We found there are a variety of Openfire forks that may or may not be vulnerable, making up about 5% of the internet-facing servers.