Krebs on Security

JUNE 1, 2023

This post is a deep dive on “ Megatraffer ,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015. 2016 sales thread on Exploit. One of Megatraffer’s ads on an English-language cybercrime forum. “Why do I need a certificate?

Malware 315

Malware Cybercrime Software Accountability 315

Krebs on Security

SEPTEMBER 10, 2021

The assault came from “ Meris ,” the same new “Internet of Things” (IoT) botnet behind record-shattering attacks against Russian search giant Yandex this week and internet infrastructure firm Cloudflare earlier this summer. By comparison, the 2016 Mirai DDoS generated approximately 450,000 requests-per-second.

IoT 354

IoT DDOS Internet Internet 354

Krebs on Security

NOVEMBER 28, 2022

But that story omitted an important historical detail about Pushwoosh: In 2013, one of its developers admitted to authoring the Pincer Trojan , malware designed to surreptitiously intercept and forward text messages from Android mobile devices. Pushwoosh was incorporated in Novosibirsk, Russia in 2016. Pushwoosh says it is a U.S.

Mobile 291

Mobile Malware Technology Government 291

Tech Republic Security

MARCH 27, 2017

Android smartphones and Internet of Things devices are increasingly at risk of attack, according to a new Nokia report. Here's how to keep your business safe.

Malware 141

Malware Internet Internet Risk 141

Krebs on Security

DECEMBER 19, 2018

Microsoft today released an emergency software patch to plug a critical security hole in its Internet Explorer (IE) Web browser that attackers are already using to break into Windows computers. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Internet 267

Internet Internet Software Engineering 267

Krebs on Security

SEPTEMBER 19, 2018

— were each sentenced to five years probation, 2,500 hours of community service, and ordered to pay $127,000 in restitution for the damage caused by their malware. . — were each sentenced to five years probation, 2,500 hours of community service, and ordered to pay $127,000 in restitution for the damage caused by their malware.

Government 241

Government Internet Internet Advertising 241

Krebs on Security

JANUARY 14, 2019

Also last week, a 30-year-old in the United Kingdom was sentenced to 32 months in jail for using an army of hacked devices to crash large portions of Liberia’s Internet access in 2016. According to court testimony, Kaye was hired in 2015 to attack Lonestar , Liberia’s top mobile phone and Internet provider.

DDOS 240

DDOS Internet Internet Spyware 240

SecureList

OCTOBER 20, 2021

We also review what pushed cybercriminals to transform their operations into the now well-known malware-as-a-service model — the use of cloud servers, the decreasing relevance of custom malware and the subsequent emergence of small, agile teams. This browser attack chain, popular in 2016, is no longer possible.

Cybercrime 145

Cybercrime Banking Malware Ransomware 145

Security Affairs

APRIL 5, 2019

Researchers at AT&T Alien Labs have spotted a malware called Xwo that is actively scanning the Internet for exposed web services and default passwords. Experts at AT&T Alien Labs discovered a new piece of malware called Xwo that is actively scanning the Internet for exposed web services and default passwords.

Internet 111

Internet Internet Passwords Malware 111

Malwarebytes

JUNE 3, 2022

Welcome to Internet Safety Month, a once-a-year event in which you, the public, are told that anywhere between three and 30 different best practices will simplify your approach to staying safe online. This year, then, for Internet Safety Month, we’re packaging our advice a little differently. Don’t ruin your device.

Internet 132

Internet Internet Passwords Scams 132

Krebs on Security

JUNE 25, 2019

” What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware. com — were implicated in propagating the Triada malware. com 2016-02-18 ALIBABA CLOUD COMPUTING (BEIJING) CO., “Yehuo” ( ? ? ) com , buydudu[.]com

Mobile 279

Mobile Technology Manufacturing Malware 279

Krebs on Security

JANUARY 22, 2019

Experts at Cisco Talos and other security firms quickly drew parallels between the two mass spam campaigns, pointing to a significant overlap in Russia-based Internet addresses used to send the junk emails. EARLY WARNING SIGNS.

DNS 277

DNS Internet Internet Computers and Electronics 277

The Last Watchdog

MARCH 13, 2019

In the not too distant future, each one of us will need to give pause, on a daily basis, to duly consider how we purchase and use Internet of Things devices and services. Only when we demand it, will the Internet of Things achieve a level of trust that makes it stable. This is coming. This time the stakes are too high. Talk more soon.

Internet 189

Internet Internet IoT Energy and Utilities 189

The Last Watchdog

MAY 15, 2023

These include ransomware targeting backend servers, distributed denial of service (DDoS) attacks, destructive malware, and even weaponizing charging stations to deploy malware. Notably, in 2016, Nissan suspended a remote telematics system in its all-electric hatchback, the Leaf, due to a vulnerability in the NissanConnect app’s server.

Malware 230

Malware Manufacturing IoT Software 230

Krebs on Security

JUNE 22, 2022

The user “RSOCKS” on the Russian crime forum Verified changed his name to RSOCKS from a previous handle: “ Stanx ,” whose very first sales thread on Verified in 2016 quickly ran afoul of the forum’s rules and prompted a public chastisement by the forum’s administrator. ” the post enthuses.

Advertising 321

Advertising Cybercrime System Administration Hacking 321

Krebs on Security

JULY 14, 2020

” “We consider this to be a wormable vulnerability, meaning that it has the potential to spread via malware between vulnerable computers without user interaction,” Microsoft wrote in its documentation of CVE-2020-1350. Not to say flaws rated “important” as opposed to critical aren’t also a concern.

DNS 349

DNS Backups Software System Administration 349

Krebs on Security

AUGUST 19, 2021

Apparently now that includes emailing employees directly and asking them to unleash the malware inside their employer’s network in exchange for a percentage of any ransom amount paid by the victim company. Image: Abnormal Security. billion in 2020. Image: FBI. For example, the Lockbit 2.0

Ransomware 363

Ransomware Social Engineering Cybercrime Scams 363

Schneier on Security

JUNE 11, 2018

The story behind this request is one of sophisticated malware and unsophisticated home-network security, and it's a harbinger of the sorts of pervasive threats ­ from nation-states, criminals and hackers ­ that we should expect in coming years. More than 500,000 routers in at least 54 countries have been infected since 2016.

Malware 197

Malware Firmware Internet Internet 197

Malwarebytes

FEBRUARY 19, 2025

The latest, major threats to Mac computers can steal passwords and credit card details with delicate precision, targeting victims across the internet based on their device, location, and operating system. These findings come from the 2025 State of Malware report. They are wildly adaptable.

Malware 130

Malware Software Passwords Cryptocurrency 130

Krebs on Security

FEBRUARY 26, 2019

Following their dramatic arrests in 2016, many news media outlets reported that the men were suspected of having tipped off American intelligence officials about those responsible for Russian hacking activities tied to the 2016 U.S. Both men maintained their innocence throughout the trial. presidential election.

Cybersecurity 269

Cybersecurity Cybercrime Media Antivirus 269

Krebs on Security

FEBRUARY 3, 2022

Way back in 2016, security firm Fortinet blogged about LinkedIn’s redirect being used to promote phishing sites and online pharmacies. Linkedin’s parent company — Microsoft Corp — is by all accounts the most-phished brand on the Internet today. Let me be clear that the activity described in this post is not new.

Phishing 359

Phishing Marketing Scams Accountability 359

Krebs on Security

JANUARY 24, 2023

Denis Emelyantsev , a 36-year-old Russian man accused of running a massive botnet called RSOCKS that stitched malware into millions of devices worldwide, pleaded guilty to two counts of computer crime violations in a California courtroom this week. RSOCKS, circa 2016. I am not a criminal and I will prove it in an American court.”

Cybercrime 301

Cybercrime Advertising IoT Malware 301

Krebs on Security

APRIL 22, 2019

The owner of a Swedish company behind a popular remote administration tool (RAT) implicated in thousands of malware attacks shares the same name as a Swedish man who pleaded guilty in 2015 to co-creating the Blackshades RAT , a similar product that was used to infect more than half a million computers with malware, KrebsOnSecurity has learned.

Advertising 257

Advertising Antivirus Software Malware 257

Security Affairs

JUNE 3, 2024

Russia-linked APT28 used the HeadLace malware and credential-harvesting web pages in attacks against networks across Europe. The experts observed the APT deploying Headlace in three distinct phases from April to December 2023, respectively, using phishing, compromised internet services, and living off the land binaries.

Malware 141

Malware Phishing Surveillance Internet 141

Krebs on Security

JUNE 15, 2021

Department of Justice (DOJ) last week announced the arrest of a 55-year-old Latvian woman who’s alleged to have worked as a programmer for Trickbot , a malware-as-a-service platform responsible for infecting millions of computers and seeding many of those systems with ransomware. 6 in Miami, Fla. Image: DOJ.

Cybercrime 359

Cybercrime Ransomware Passwords Banking 359

Krebs on Security

OCTOBER 26, 2018

The convicted co-author of the highly disruptive Mirai botnet malware strain has been sentenced to 2,500 hours of community service, six months home confinement, and ordered to pay $8.6 million in restitution for repeatedly using Mirai to take down Internet services at Rutgers University , his former alma mater. After the Sept.

DDOS 228

DDOS Government Malware Internet 228

Security Boulevard

JANUARY 26, 2022

In this analysis we’ll take a closer look at the Internet connected infrastructure behind the U.S Election 2016 campaign in terms of malicious activity and offer practical and relevant including actionable threat intelligence on their whereabouts. Elections 2016 campaign: linuxkrnl[.]net. Elections 2016 campaign: linuxkrnl[.]net.

Accountability 96

Accountability DNS Phishing Social Engineering 96

Security Affairs

OCTOBER 3, 2020

Facebook shared details about a long-running ad-fraud campaign that’s been ongoing since 2016 targeting Facebook users with SilentFade malware. The social network giant revealed that malware has a Chinese origin and allowed hackers to siphon $4 million from users’ advertising accounts. Pierluigi Paganini.

Malware 128

Malware Advertising Accountability Authentication 128

Krebs on Security

JUNE 28, 2022

On December 7, 2021, Google announced it was suing two Russian men allegedly responsible for operating the Glupteba botnet, a global malware menace that has infected millions of computers over the past decade. The employees who kept things running for RSOCKS, circa 2016. PPI programs) to generate new installations of their malware.”

Passwords 323

Passwords Malware Internet Internet 323

Krebs on Security

FEBRUARY 11, 2020

Microsoft today released updates to plug nearly 100 security holes in various versions of its Windows operating system and related software, including a zero-day vulnerability in Internet Explorer (IE) that is actively being exploited. It could be used to install malware just by getting a user to browse to a malicious or hacked Web site.

Backups 68

Backups Malware Internet Internet 68

Krebs on Security

SEPTEMBER 8, 2020

None of the flaws are known to be currently under active exploitation, but 23 of them could be exploited by malware or malcontents to seize complete control of Windows computers with little or no help from users. “We have seen the previously patched Exchange bug CVE-2020-0688 used in the wild, and that requires authentication.

Software 325

Software Backups Authentication Internet 325

Malwarebytes

JUNE 8, 2022

The common wisdom goes that Linux malware is rare, and for the most part this is true. Thanks to its built-in security defenses, strict user privilege model, and transparent source code, Linux enjoys far fewer malware infections than other operating systems. Cloud Snooper. How it works. HiddenWasp. How it works. How it works.

Malware 125

Malware IoT DDOS Firewall 125

Krebs on Security

JUNE 25, 2019

” What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware. com — were implicated in propagating the Triada malware. com 2016-02-18 ALIBABA CLOUD COMPUTING (BEIJING) CO., “Yehuo” ( ? ? ) com , buydudu[.]com

Mobile 189

Mobile Technology Manufacturing Software 189

Krebs on Security

JULY 29, 2022

re is was one of the original “residential proxy” networks, which allow someone to rent a residential IP address to use as a relay for his/her Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web. A cached copy of flashupdate[.]net

Cybercrime 326

Cybercrime Software VPN Backups 326

eSecurity Planet

OCTOBER 4, 2022

Malicious programs or malware are common and dangerous threats in the digital space for both individual users and organizations alike. German IT-Security Institute AV-TEST has recorded over 1 billion malicious programs as of this writing, with over 450,000 new instances of malware being recorded every day. Malvertising.

Malware 125

Malware Phishing Ransomware Mobile 125

CyberSecurity Insiders

AUGUST 13, 2021

Tenable researchers claim hackers are exploiting a security flaw termed authentication-bypass vulnerability that is impact routers and internet of things (IoT) devices. Mirai is a kind of malware that turns connected devices into remotely controlled devices called Bots.

Firmware 136

Firmware Malware DDOS Manufacturing 136

Krebs on Security

MAY 13, 2024

This post examines the activities of Khoroshev’s many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years. This user said they specialize in developing malware, creating computer worms, and crafting new ways to hijack Web browsers.

Ransomware 316

Ransomware Cybercrime Accountability Malware 316