2015, Architecture, DNS and Malware - Cyber Security Informer

2015

Architecture

DNS

Malware

Godlua backdoor, the first malware that abuses the DNS over HTTPS (DoH)

Security Affairs

JULY 4, 2019

The peculiarity of this new piece of malware is the ability to communicate with C2 servers via DNS over HTTPS ( DoH ). The DoH protocol was a new standard proposed in October 2018 and it is currently supported by several publicly available DNS servers. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

DNS

DNS Malware Advertising DDOS

Massive increase in XorDDoS Linux malware in last six months

Malwarebytes

MAY 25, 2022

Based on a case study in 2015 , Akamai strengthened the theory that the malware may be of Asian origin based on its targets. Microsoft said that XorDDoS continues to home on Linux-based systems, demonstrating a significant pivot in malware targets. MMD believed the Linux Trojan originated in China.

Malware

Malware IoT DDOS DNS

Join 29,000+

Insiders

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Webinars

Reimagining Cybersecurity Training: Driving Real Impact on Security Culture

MORE WEBINARS

Trending Sources

Trend Micro observed notable malware activity associated with the Momentum Botnet

Security Affairs

DECEMBER 18, 2019

Security experts recently found notable malware activity affecting devices running Linux that is associated with the Momentum Botnet. Malware researchers from Trend Micro recently observed notable malware activity affecting devices running Linux that is associated with the Momentum Botnet. ” concludes the analysis.

Malware

Malware DDOS DNS Advertising

Webinars

Reimagining Cybersecurity Training: Driving Real Impact on Security Culture

MORE WEBINARS

Winnti APT group uses skip-2.0 malware to control Microsoft SQL Servers

Security Affairs

OCTOBER 21, 2019

Security experts have a new malware, dubbed skip-2.0 Security experts at ESET have discovered a new malware, dubbed skip-2.0, malware was used by threat actors to establish a backdoor in MSSQL Server 11 and 12 servers, allowing them to access to any account on the server using a “magic password.” The skip-2.0

Malware

Malware Passwords Advertising DNS

Chalubo, a new IoT botnet emerges in the threat landscape

Security Affairs

OCTOBER 23, 2018

Security experts from Sophos Labs have spotted a new piece of IoT malware tracked as Chalubo that is attempting to recruit devices into a botnet used to launch DDoS attacks. The attackers were using brute-force attacks (using the root:admin credential) on SSH servers to distribute the malware. ” continues the analysis.

IoT

IoT DDOS Architecture Malware

Operation ‘Harvest’: A Deep Dive into a Long-term Campaign

McAfee

SEPTEMBER 14, 2021

A special thanks to our Professional Services’ IR team, ShadowServer , for historical context on C2 domains, and Thomas Roccia /Leandro Velasco for malware analysis support. McAfee customers are protected from the malware/tools described in this blog. The malware also decrypts and injects the payload in memory.

Malware

Malware DNS Accountability Manufacturing

Winnti Group was planning a devastating supply-chain attack against Asian manufacturer

Security Affairs

OCTOBER 14, 2019

Researchers also discovered that the APT group used an updated version of its ShadowPad malware. This type of backdoor is sometimes called a passive network implant “ In the attack against a video game developer, the malware was being distributed via a game’s official update server. SecurityAffairs – Winnti, malware).

Manufacturing

Manufacturing Mobile Malware Software

Unveiling JsOutProx: A New Enterprise Grade Implant

Security Affairs

DECEMBER 20, 2019

Experts at Yoroi/Cybaze ZLab spotted a new sophisticated malware implant dubbed JsOutProx that seems to be unrelated to mainstream cyber weapons. During our threat intelligence source monitoring operations, we spotted a new sophisticated malware implant, dubbed JsOutProx, that seems to be unrelated to mainstream cyber weapons.

Malware

Malware DNS Architecture Advertising

APT trends report Q1 2022

SecureList

APRIL 27, 2022

Disclaimer: when referring to APT groups as Russian-speaking, Chinese-speaking or other-“speaking” languages, we refer to various artefacts used by the groups (such as malware debugging strings, comments found in scripts, etc.) On February 23, ESET published a tweet announcing new wiper malware targeting Ukraine.

Malware

Malware Firmware Government Phishing

Analyzing a Danabot Paylaod that is targeting Italy

Security Affairs

DECEMBER 20, 2018

The malware tries to connect to the remote host 149.154.157.104 (EDIS-IT IT) through an encrypted SSL channel, then it downloads other components and deletes itself from the filesystem. Registry key created by malware. Figure 2: Complete malware implant folder. exe process according to the architecture of the compromised host.

Banking

Banking Malware Internet Internet

New Linux/DDosMan threat emerged from an evolution of the older Elknot

Security Affairs

APRIL 1, 2019

The popular expert unixfreaxjp analyzed a new China ELF DDoS’er malware tracked as “Linux/DDoSMan” that evolves from the Elknot malware to deliver new ELF bot. But what kind of malware is this Elknot Trojan? This malware is an update and reuse from the Elknot’s malware source code.

DDOS

DDOS Malware Encryption Penetration Testing

Black Hat USA 2023 NOC: Network Assurance

Cisco Security

AUGUST 28, 2023

XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. SCA detected 289 alerts including Suspected Port Abuse, Internal Port Scanner, New Unusual DNS Resolver,and Protocol Violation (Geographic).

Wireless

Wireless DNS Mobile Technology

Iranian Threat Actors: Preliminary Analysis

Security Affairs

JANUARY 15, 2020

Bonupdater, Helminth, Quadangent and PowRuner are some of the most sophisticated Malware attributed to OilRig and analyzed over the past few years. APT33 showed destruction intents by using Malware such as shamoon and stoneDrill , while Muddy mostly wants to “ backdooring ” the victims. CopyKittens. Cleaver TTP.

Computers and Electronics

Computers and Electronics Penetration Testing Malware Government

Group-IB presents its annual report on global threats to stability in cyberspace

Security Affairs

NOVEMBER 29, 2019

The past months have shown that the most dangerous hacks involved DNS hijacking, which helped attackers manipulate DNS records for MITM attacks. Compromising IT networks using traditional techniques and malware — including living off the land attacks — is the main vector for penetrating isolated segments of OT networks.

Banking

Banking Telecommunications Marketing Internet

Cyber Security Informer

Godlua backdoor, the first malware that abuses the DNS over HTTPS (DoH)

Massive increase in XorDDoS Linux malware in last six months

Webinars

Trending Sources

Trend Micro observed notable malware activity associated with the Momentum Botnet

Webinars

Winnti APT group uses skip-2.0 malware to control Microsoft SQL Servers

Top SD-WAN Solutions for Enterprise Security

Chalubo, a new IoT botnet emerges in the threat landscape

Operation ‘Harvest’: A Deep Dive into a Long-term Campaign

Winnti Group was planning a devastating supply-chain attack against Asian manufacturer

Unveiling JsOutProx: A New Enterprise Grade Implant

APT trends report Q1 2022

Analyzing a Danabot Paylaod that is targeting Italy

New Linux/DDosMan threat emerged from an evolution of the older Elknot

Black Hat USA 2023 NOC: Network Assurance

Iranian Threat Actors: Preliminary Analysis

Group-IB presents its annual report on global threats to stability in cyberspace

Stay Connected