Security Affairs

FEBRUARY 24, 2020

Raccoon Malware is a recently discovered infostealer that can extract sensitive data from about 60 applications on a targeted system. Racoon malware , Legion, Mohazo, and Racealer, is an infostealer that recently appeared in the threat landscape that is advertised in hacking forums. ” reads the report published by CyberArk.

Cybercrime 86

Cybercrime Malware Cryptocurrency Advertising 86

Security Affairs

SEPTEMBER 16, 2018

Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. The post Feedify cloud service architecture compromised by MageCart crime gang appeared first on Security Affairs. Pierluigi Paganini.

Architecture 81

Architecture Advertising Cybercrime Malware 81

Security Affairs

SEPTEMBER 24, 2020

Security researchers spotted a new strain of Android malware, dubbed Alien, that implements multiple features allowing it to steal credentials from 226 apps. Alien first appeared in the threat landscape early this year, its model of sale is Malware-as-a-Service (MaaS) and is advertised on several underground hacking forums.

Banking 81

Banking Malware Advertising Architecture 81

Security Affairs

SEPTEMBER 10, 2020

ESET researchers discovered a new piece of malware dubbed CDRThief targets a specific Voice over IP system to steal call data records (CDR). The VoIP platform Linknat VOS2009 and VOS3000 targeted by the malware is used by two China-produced softswitches (software switches). ” reads the analysis published by ESET.

Malware 64

Malware Encryption Advertising Passwords 64

Security Affairs

JUNE 26, 2019

Security experts warn of a new piece of the Silex malware that is bricking thousands of IoT devices, and the situation could rapidly go worse. Cashdollar explained that the Silex malware trashes the storage of the infected devices, drops firewall rules and wipe network configurations before halting the system. ” reported ZDnet.

IoT 93

IoT Malware Advertising Firmware 93

Security Affairs

MAY 31, 2019

Security experts at Intezer have discovered a new Linux malware tracked as ‘HiddenWasp’ that borrows from Mirai, Azazel malicious codes. HiddenWasp is a new sophisticated Linux malware still undetected by the majority of anti-virus solutions. According to the experts at Intezer, the malware was involved in targeted attacks. .

Malware 88

Malware Advertising DDOS Architecture 88

Security Affairs

DECEMBER 18, 2019

Security experts recently found notable malware activity affecting devices running Linux that is associated with the Momentum Botnet. Malware researchers from Trend Micro recently observed notable malware activity affecting devices running Linux that is associated with the Momentum Botnet. ” concludes the analysis.

Malware 60

Malware DDOS DNS Advertising 60

Security Affairs

APRIL 17, 2022

The botnet targets multiple architectures, including arm, bsd, x64, and x86. Experts pointed out that the malware is being actively developed. Gafgyt is a popular choice for launching large-scale DDoS attacks, it first appeared in the threat landscape in 2014. Upon installing the threat, the bot drops a file in /tmp/.pwned

DDOS 129

DDOS Architecture Malware Cybercrime 129

Security Affairs

OCTOBER 7, 2020

Experts noticed that the malware supports multiple CPU architectures, including x86(32/64), ARM(32/64), MIPS(MIPS32/MIPS-III) and PPC, it is written in the Go open-source programming language. Upon gaining access to the device, the bot downloads one of seven binaries that install the HEH malware. ” concludes the post.

Architecture 113

Architecture IoT Malware Advertising 113

Security Affairs

JULY 4, 2019

The peculiarity of this new piece of malware is the ability to communicate with C2 servers via DNS over HTTPS ( DoH ). ” Godlua is the first malware that abuses the DNS over HTTPS (DoH) protocol to protect its command and control infrastructure. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

DNS 79

DNS Malware Advertising DDOS 79

Security Affairs

MAY 26, 2023

The experts highlight that the vulnerability exploited in the attacks has been in existence since 2014. According to a screenshot taken by the malware author, the botnet was composed of at least 414 machines as of February 2023. Most of the infected machines are based on ARMv4 architectures, specifically MIPSEL and x86.

DDOS 87

DDOS Architecture Malware Hacking 87

CyberSecurity Insiders

JANUARY 26, 2022

In November 2021, AT&T Alien Labs™ first published research on our discovery of new malware written in the open-source programming language Golang. The team named this malware “BotenaGo.” Key takeaways: BotenaGo malware source code is now available to any malicious hacker or malware developer.

Malware 81

Malware IoT Authentication Antivirus 81

Security Affairs

AUGUST 17, 2020

The malware has evolved over the years, it is able to log keystrokes, steal files, capture screenshots, collect information about the infected system, steal credentials from major browsers (i.e. The malware has been active since at least 2014, it was undetected for more than 3 years and was used in highly targeted attacks.

Phishing 115

Phishing Malware Advertising Architecture 115

Security Affairs

AUGUST 26, 2020

Experts discovered a new hacker hacker-for-hire group that is targeting organizations worldwide with malware hidden inside malicious 3Ds Max plugins. Security researchers from Bitdefender discovered a new hacker group that is currently targeting companies across the world with malware hidden inside malicious 3Ds Max plugins.

Architecture 93

Architecture Malware Advertising Software 93

Security Affairs

APRIL 10, 2019

Palo Alto Networks researchers discovered a new variant of the Mirai malware that is targeting more processor architectures than previous ones. Mirai malware first appeared in the wild in 2016 when the expert MalwareMustDie discovered it in massive attacks aimed at Internet of Things (IoT) devices. Pierluigi Paganini.

Architecture 89

Architecture DDOS IoT Internet 89

Security Affairs

SEPTEMBER 20, 2020

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware , it appeared on the threat landscape in late 2019. The malware spreads by attempting to guess Telnet passwords of target devices and leveraging known exploits. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

IoT 119

IoT DDOS Architecture Passwords 119

CyberSecurity Insiders

NOVEMBER 11, 2021

AT&T Alien Labs™ has found new malware written in the open source programming language Golang. The malware creates a backdoor and waits to either receive a target to attack from a remote operator through port 19412 or from another related module running on the same machine. VirusTotal scanning results of BotenaGo malware.

Malware 85

Malware IoT Firmware Authentication 85

Security Affairs

MAY 16, 2020

Experts spotted a new malware dubbed QNodeService that was involved in Coronavirus-themed phishing campaign, crooks promise victims COVID-19 tax relief. Researchers uncovered a new malware dubbed QNodeService that was employed in a Coronavirus-themed phishing campaign. malware file (either “qnodejs-win32-ia32.js”

Malware 105

Malware Phishing Advertising Antivirus 105

Security Affairs

OCTOBER 5, 2020

A China-linked threat actor used UEFI malware based on code from Hacking Team in attacks aimed at organizations with an interest in North Korea. Researchers from Kaspersky have spotted a UEFI malware that was involved in attacks on organizations with an interest in North Korea. Pierluigi Paganini. SecurityAffairs – hacking, UEFI).

Firmware 122

Firmware Spyware Surveillance Hacking 122

Security Affairs

OCTOBER 10, 2020

TA505 hacking group has been active since 2014 focusing on Retail and banking sectors. Attacks showing up in commodity malware like those used by the threat actor CHIMBORAZO indicate broader exploitation in the near term.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. states Microsoft.

Cybercrime 110

Cybercrime Security Intelligence Authentication Banking 110

Security Affairs

NOVEMBER 21, 2019

The new DePriMon downloader was used by the Lambert APT group, aka Longhorn, to deploy malware. The group is very sophisticated and used zero-day exploits and complex malware to conduct targeted attacks against governments and organizations in almost every industry, including financial, energy, telecommunications, and education, aerospace.

Malware 101

Malware Telecommunications Advertising Encryption 101

Security Affairs

SEPTEMBER 19, 2018

We downloaded the sample directly from the compromised server, we found four samples of the Gafgyt variant that were already compiled for the specific architecture, X86-64, X86-32, MIPS, ARM. The report includes a detailed analysis of the malware. You can download the full ZLAB Malware Analysis Report at the following URL: [link].

Advertising 82

Advertising Malware Architecture Internet 82

Security Affairs

MAY 15, 2020

Since December 2014, the threat actors are using a malware dubbed USBferry in attacks against military/navy agencies, government institutions, military hospitals, and also a national bank. The malware was first mentioned in a PwC report that attributes it to Tropic Trooper APT, but that did not include a detailed analysis.

Government 99

Government Malware Advertising Architecture 99

Security Affairs

OCTOBER 21, 2019

Security experts have a new malware, dubbed skip-2.0 Security experts at ESET have discovered a new malware, dubbed skip-2.0, malware was used by threat actors to establish a backdoor in MSSQL Server 11 and 12 servers, allowing them to access to any account on the server using a “magic password.” The skip-2.0

Malware 44

Malware Passwords Advertising DNS 44

Security Affairs

OCTOBER 28, 2020

Office furniture company Steelcase was hit by Ryuk ransomware attack that forced it to shut down its network to avoid the malware from spreading. Steelcase is a US-based furniture company that produces office furniture, architectural and technology products for office environments and the education, health care and retail industries.

Ransomware 93

Ransomware Computers and Electronics Manufacturing Advertising 93

Security Affairs

AUGUST 1, 2019

The malware’s command center is hidden to make takedowns a more complicated process. Mirai malware first appeared in the wild in 2016 when the expert MalwareMustDie discovered it in massive attacks aimed at Internet of Things (IoT) devices. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Architecture 78

Architecture IoT Malware Advertising 78

Security Affairs

SEPTEMBER 13, 2019

The WatchBog bot is a Linux-based malware that is active since last year, it targets systems to mine for the Monero virtual currency. The attackers were able to exploit CVE-2018-1000861 to gain a foothold and install the Watchbog malware on the affected systems.” ” states the analysis published by Cisco Talos.

Architecture 80

Architecture Cryptocurrency Malware Advertising 80

Security Affairs

OCTOBER 2, 2020

The malware samples analyzed by the researchers are slightly obfuscated using string obfuscation and dynamic Windows API library loading. The malware supports multiple features, including the monitoring of removable drives, taking screenshots, exfiltrating documents, and collecting nearby Wi-Fi access point identifiers. “We

Malware 133

Malware Government Advertising Phishing 133

Security Affairs

FEBRUARY 9, 2020

. “The modus operandi of the group behind this specific attack comes over with a criminal group that already has one has a long history, and goes back to at least 2014,” reads the Fox-IT full report to UM (in Dutch). TA505 hacking group has been active since 2014 focusing on Retail and banking sectors. Pierluigi Paganini.

Ransomware 103

Ransomware Cyber Attacks Architecture Backups 103

Security Affairs

APRIL 8, 2020

“For example, payloads are compiled for 12 different CPU architectures and dynamically delivered based on the victim’s configuration.” The experts discovered at customized payloads for at least 12 different CPU architectures. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

IoT 72

IoT DDOS Architecture Advertising 72

Security Affairs

MAY 7, 2019

Attackers use the LightNeuron malware to access and modify any email passing through the compromised mail server. Malware researchers believe Turla is using the malware at least since 2014 to target Microsoft Exchange servers. “ LightNeuron is a very powerful piece of malware. ” continues the analysis.

Malware 67

Malware Advertising Architecture Government 67

Security Affairs

JUNE 22, 2020

If this level of access is acquired, an attacker could potentially manipulate the AMD Generic Encapsulated Software Architecture (AGESA) to execute arbitrary code undetected by the operating system.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Firmware 91

Firmware Architecture Advertising Manufacturing 91

Security Affairs

OCTOBER 23, 2018

Security experts from Sophos Labs have spotted a new piece of IoT malware tracked as Chalubo that is attempting to recruit devices into a botnet used to launch DDoS attacks. The attackers were using brute-force attacks (using the root:admin credential) on SSH servers to distribute the malware. ” continues the analysis.

IoT 78

IoT DDOS Architecture Malware 78

Security Affairs

OCTOBER 18, 2018

ESET researchers have spotted a new strain of malware tracked as Exaramel that links the not Petya wiper to the Industroyer ICS malware. The APT group leverage the GreyEnergy malware, a malicious code that implements a modular architecture to extend its capabilities by adding the appropriate modules. ” states ESET.

Malware 87

Malware Architecture Advertising Phishing 87

Security Affairs

SEPTEMBER 2, 2019

The researchers revealed that one of his honeypots was hit by this IoT malware that targets Intel machines running Linux. ” The expert explained that the XMR cryptominer was optimized for Intel x86 (both 32bit or 64bit architecture) and Intel 686 processors. .” “This one seems to target enterprise systems.”

IoT 86

IoT Cryptocurrency Malware System Administration 86

Security Affairs

JANUARY 24, 2020

A US Government agency was hit with a phishing attack attempting to deliver a new malware dropper dubbed CARROTBALL. Security experts at Palo Alto Networks have uncovered a new malware dropper called CARROTBALL that was used in targeted attacks against a U.S. Both downloaders were used to deliver the second-stage SYSCON malware.

Malware 101

Malware Government Advertising Phishing 101

Security Affairs

JULY 11, 2019

Malware researchers from Kaspersky have discovered new and improved versions of the infamous FinFisher spyware used to infect both Android and iOS devices. The implant analyzed by the experts contained binary files for ARMv7 and ARM64 CPU architectures. “FinSpy developers are constatly working on the updates for their malware.

Spyware 95

Spyware Mobile Advertising Architecture 95