article thumbnail

XDSpy APT remained undetected since at least 2011

Security Affairs

Researchers from ESET uncovered the activity of a new APT group, tracked as XDSpy, that has been active since at least 2011. XDSpy is the name used by ESET researchers to track a nation-state actor that has been active since at least 2011. XDPass: Grabs saved passwords from various applications such as web browsers and email programs.

Malware 136
article thumbnail

The Link Between AWM Proxy & the Glupteba Botnet

Krebs on Security

AWMproxy, the storefront for renting access to infected PCs, circa 2011. In 2011, researchers at Kaspersky Lab showed that virtually all of the hacked systems for rent at AWM Proxy had been compromised by TDSS (a.k.a An example of a cracked software download site distributing Glupteba. Image: Google.com. But on Dec.

Passwords 229
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

Kilmer said Faceless has emerged as one of the underground’s most reliable malware-based proxy services, mainly because its proxy network has traditionally included a great many compromised “Internet of Things” devices — such as media sharing servers — that are seldom included on malware or spam block lists.

Malware 221
article thumbnail

Who Is the Network Access Broker ‘Babam’?

Krebs on Security

More commonly, that access is purchased from a cybercriminal broker who specializes in acquiring remote access credentials — such as usernames and passwords needed to remotely connect to the target’s network. com back in 2011, and sanjulianhotels[.]com The username associated with that account was “ bo3dom.”

article thumbnail

US Gov’s Cyber Survival Guide for Water Utilities

Centraleyes

Several facilities have faced the wrath of ransomware attacks, from the South Houston wastewater treatment plant in 2011 to a Pennsylvania water system in May 2021. It was reassuring to know that the safety of drinking water wasn’t compromised, thanks to swift action and existing safeguards.

article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

has been associated with the user Kerens on the Russian hacking forum Exploit from 2011 to the present day. The very first post by Kerens on Exploit in 2011 was a negative review of a popular crypting service that predated Cryptor[.]biz frequently relied on the somewhat unique password, “ plk139t51z.”

Malware 208
article thumbnail

Zloader, another botnet, bites the dust

Malwarebytes

There are a lot of those because the ZeuS banking Trojan source code was leaked in 2011, and so there’s been plenty of time for several new variants to emerge. A sinkhole is a way of redirecting malicious internet traffic so that it can be captured and analyzed by security professionals, and are often used to seize control of botnets.

Backups 123