SecureList

AUGUST 30, 2023

While investigating an infection of a cryptocurrency company in Southeast Asia, we found Gopuram coexisting on target computers with AppleJeus , a backdoor attributed to the Lazarus. The threat actor specifically targeted cryptocurrency companies. We observed that they have a specific interest in cryptocurrency companies.

Malware 78

Malware Spyware Cryptocurrency Government 78

Security Affairs

MARCH 19, 2019

We expect that that other APTs like Silence , MoneyTaker , and Cobalt will stage multiple attacks on cryptocurrency exchanges in the near future,” – says Dmitry Volkov. Cybercriminals steal user accounts’ data using special spyware aimed at obtaining users’ authentication data. Have you been pwned?

Banking 77

Banking Government Passwords Marketing 77

SecureList

NOVEMBER 18, 2022

In another, they were able to compromise a WebLogic server through an exploit for the CVE-2017-10271 vulnerability, which ultimately allowed them to run a script. VileRAT is a Python implant, part of an evasive and highly intricate attack campaign against foreign exchange and cryptocurrency trading companies.

Malware 105

Malware Computers and Electronics Adware Cryptocurrency 105

Security Affairs

APRIL 5, 2019

Ursnif/Gozi is active from over a decade and was one of the most active malware listed in 2017 and 2018. A few days ago, the researchers of ZLab Yoroi-Cybaze dissected another attack wave of the infamous Ursnif malware, also known as Gozi ISFB , an offspring of the original Gozi which source code was leaked in 2014.

Banking 84

Banking Malware Cryptocurrency Advertising 84

SecureList

DECEMBER 1, 2023

However, they included an additional module that constantly monitored the messenger and sent data to the spyware creator’s C2 server. Instead, it tried to exploit the CVE-2017-0199 vulnerability. We examined the code in the apps and found that they were only slightly modified versions of the official Telegram app.

Malware 98

Malware Ransomware Encryption Energy and Utilities 98

SecureList

FEBRUARY 16, 2023

These sites referenced public figures and humanitarian groups, offering to accept cash in cryptocurrency, something that should have raised a red flag in itself. By getting the user’s secret phrase, cybercriminals could get access to their cryptocurrency balance. Now, attackers have started collecting Bitcoin for charity.

Phishing 96

Phishing Scams Accountability Energy and Utilities 96

SecureList

AUGUST 5, 2021

or cryptocurrency secured by these resources. Exploits for CVE-2017-11882 (4.07%), an Equation Editor vulnerability popular with cybercriminals, gave ground and dropped to fourth place. Sixth and eighth places were occupied by Noon spyware Trojans, which infect any (2.66%) or only 32-bit (2.47%) versions of Windows.

Phishing 119

Phishing Banking Scams Computers and Electronics 119

SecureList

MARCH 1, 2021

The word “covid” in various combinations was typically used in the names of packages hiding spyware and banking Trojans, adware or Trojan droppers. It stole credentials for various financial systems including online banking applications and cryptocurrency wallets in Brazil. This malware was first spotted in 2017.

Mobile 138

Mobile Malware Adware Banking 138