Security Affairs

FEBRUARY 1, 2019

It retrieves: System Info; Computer IP address; Network status; List of running processes; Available privileges; Usernames; Domain Admins; File on desktop machine; AntiVirus product on computer. Last DNS activity was in December 2018. Figure 14 – previous DNS of C2. Figure 7 – System information stealed by malware.

Malware 84

Malware DNS Social Engineering Advertising 84

Security Affairs

APRIL 9, 2019

The installed payload actually is a Base64 encoded PE32 file, file-lessly stored within the registry hive to avoid antivirus detection. Also, the attacker behind this sample leans on the Dynamic DNS service “warzonedns.com”, pointing to the 213.183.58[.10 Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Malware 71

Malware Advertising DNS Antivirus 71

Security Affairs

JUNE 4, 2019

The group was first discovered by Symantec and TrendMicro in 2015 but evidence of its activities has been dated back to 2013. Moreover, querying the services behind the latest associated DNS record the host responds with “403 Forbidden” message too, indicating the infrastructure may still be operative. Pierluigi Paganini.

Passwords 63

Passwords DNS Engineering Malware 63

Security Affairs

AUGUST 19, 2019

It involves DNS cache poisoning as it redirects users to a malicious site even if they enter the correct web address. Another successful strategy for preventing phishing is to secure your device using anti-malware, antivirus, VPN and other security softwares. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Phishing 88

Phishing Accountability Authentication Passwords 88

Security Affairs

JULY 7, 2019

Firefox finally addressed the Antivirus software TLS Errors. Godlua backdoor, the first malware that abuses the DNS over HTTPS (DoH). Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. A cyberattack took offline websites of the Georgia agency. Cyber Defense Magazine – July 2019 has arrived.

Scams 48

Scams Spyware DNS Advertising 48

eSecurity Planet

FEBRUARY 8, 2021

PoSeidon malware, discovered by Cisco researchers in 2015, installs a keylogger and searches the POS device’s memory for number sequences that match credit card data — then uploads that data to an exfiltration server. Multi-factor authentication is also required for remote access.

Retail 52

Retail Encryption Malware Artificial Intelligence 52

SecureList

APRIL 27, 2021

Although Lyceum still prefers taking advantage of DNS tunneling, it appears to have replaced the previously documented.NET payload with a new C++ backdoor and a PowerShell script that serve the same purpose. Ferocious Kitten is an APT group that has been active against Persian-speaking individuals since 2015 and appears to be based in Iran.

Malware 138

Malware Spyware Government Social Engineering 138