SecureList

MARCH 28, 2023

Although we have written about a similar malware attack in 2017 in one of our blogposts , the technique is still very relevant today as it doesn’t have any perfect solution from the perspective of operating system design. A password-protected RAR archive (random password).

Cryptocurrency 107

Cryptocurrency Malware Banking Passwords 107

Malwarebytes

JULY 30, 2021

LemonDuck has evolved from a Monero cryptominer into LemonCat, a Trojan that specializes in backdoor installation, credential and data theft, and malware delivery, according to the Microsoft 365 Defender Threat Intelligence Team, which explained their findings in a two-part story [ 1 ][ 2 ] on the Microsoft Security blog.

Malware 93

Malware Penetration Testing Passwords Antivirus 93

CyberSecurity Insiders

MAY 31, 2023

This blog was jointly written with Alejandro Prada and Ofer Caspi. It has been historically associated with malicious activity performed by threat actors, APT groups (like in this Mandiant report from 2017), or government attacks (in this report by Unit42 in 2017). in March 2023, which is the most current version.

Malware 117

Malware Antivirus Encryption Advertising 117

Krebs on Security

JUNE 25, 2019

In July 2017, Russian antivirus vendor Dr.Web published research showing that Triada had been installed by default on at least four low-cost Android models. Google declined to elaborate on its blog post. Shanghai Wildfire did not respond to multiple requests for comment.

Mobile 254

Mobile Technology Manufacturing Malware 254

Krebs on Security

JUNE 25, 2019

In July 2017, Russian antivirus vendor Dr.Web published research showing that Triada had been installed by default on at least four low-cost Android models. Google declined to elaborate on its blog post. Shanghai Wildfire did not respond to multiple requests for comment.

Mobile 169

Mobile Technology Manufacturing Software 169

Security Affairs

OCTOBER 17, 2018

How Microsoft Excel is able to decrypt such a content if no password is requested to the end user? Using an encrypted payload is quite a common way to evade Antivirus, since the encrypted payload changes depending on the used key. It makes an explicit date control check to 0x7E1 (2017). Stage1: Encrypted Content.

Malware 87

Malware Computers and Electronics Encryption Penetration Testing 87

SecureList

FEBRUARY 15, 2021

The email antivirus was triggered most frequently by email messages containing members of the Trojan.Win32.Agentb We assume that those who called the numbers were asked to provide the login and password for the service that the scammers were imitating, or to pay for some diagnostics and troubleshooting services. Agentb malware family.

Phishing 139

Phishing Malware Scams Accountability 139

eSecurity Planet

FEBRUARY 8, 2021

According to security firm Gemini Advisory, the Fin7 hacker group stole data on more than five million credit and debit cards that had been used at HBC credit card terminals beginning in May 2017. Evolving threats. Multi-factor authentication is also required for remote access. And that’s not just true for your security team.

Retail 52

Retail Encryption Malware Artificial Intelligence 52

SecureList

AUGUST 12, 2021

Web antivirus recognized 675,832,360 unique URLs as malicious. Our file antivirus detected 68,294,298 unique malicious and potentially unwanted objects. In their blog, DarkSide’s creators heaped the blame on third-party operators. Ransomware attacks were defeated on the computers of 97,451 unique users. are still current.

Adware 97

Adware Malware Ransomware IoT 97

Security Affairs

APRIL 9, 2019

The installed payload actually is a Base64 encoded PE32 file, file-lessly stored within the registry hive to avoid antivirus detection. Stealer and CryptoStealer module to steal cryptocurrency wallets and saved passwords. Technical details, including IoCs and Yara Rules, are available in the analysis published on the Yoroi blog.

Malware 69

Malware Advertising DNS Antivirus 69

SecureList

JANUARY 11, 2021

On December 13, 2020, FireEye published a blog post detailing a supply chain attack leveraging Orion IT, an infrastructure monitoring and management platform by SolarWinds. In a previous blog, we dissected the method used by Sunburst to communicate with its C2 server and the protocol by which victims are upgraded for further exploitation.

Malware 65

Malware Media Internet Internet 65

Fox IT

MAY 4, 2021

In 2017, yet another new version was detected in the wild with a number of major modifications compared to the previous main variant: Rebranded RM loader (called RM3 ) Used exotic PE file format exclusively designed for this banking malware Modular architecture Network communication reworked New modules. Module list.

Banking 98

Banking Malware Encryption Architecture 98