Krebs on Security

MAY 13, 2024

This post examines the activities of Khoroshev’s many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years. used the password 225948. Dmitry Yuryevich Khoroshev. Image: treasury.gov. On May 7, the U.S. and admin@stairwell.ru

Ransomware 244

Ransomware Cybercrime Accountability Malware 244

Malwarebytes

APRIL 11, 2022

Security researchers at Cado Security, a cybersecurity forensics company, recently discovered the first publicly-known malware targeting Lambda , the serverless computing platform of Amazon Web Services (AWS). The malware’s name is inspired by the domain the threat actors behind the cryptominer communicate with.

Malware 90

Malware Accountability Encryption Software 90

Security Affairs

JULY 19, 2020

The four malware families are named Guildma, Javali, Melcoz, and Grandoreiro, experts believe are the result of a Brazilian banking group/operation that is evolving its capabilities targeting banking users abroad. Experts noticed that the malware uses the BITSAdmin tool to download the additional modules. ” continues Kaspersky.

Banking 100

Banking Malware Phishing Advertising 100

Security Affairs

OCTOBER 25, 2022

Researchers reported that threat actors used 2 PoS malware variants to steal information about more than 167,000 credit cards. Cybersecurity firm Group-IB discovered two PoS malware to steal data associated with more than 167,000 credit cards from point-of-sale payment terminals. MajikPOS is written using the “.NET

Malware 75

Malware Cybercrime Banking Marketing 75

Security Affairs

JULY 28, 2020

US and UK cybersecurity agencies issued a joint advisory about the spread of QSnatch Data-Stealing Malware that already infected over 62,000 QNAP NAS devices. The QSnatch malware implements multiple functionalities, such as: . These are encrypted with the actor’s public key and sent to their infrastructure over HTTPS.

Malware 100

Malware Firmware Advertising Manufacturing 100

SecureList

OCTOBER 7, 2021

According to our data, its main vector of distribution is cracking RDP passwords. The malware also sends a message with this information via Telegram. Encrypted files and a note from the attackers. The malware encrypts files using the AES-256 algorithm in CBC mode. This ransomware has been around since 2017.

Ransomware 116

Ransomware Encryption Passwords Malware 116

Security Affairs

AUGUST 9, 2022

The emails used weaponized Microsoft Word documents exploiting the CVE-2017-11882 vulnerability. The CVE-2017-11882 flaw is a memory-corruption issue that affects all versions of Microsoft Office released between 2000 and 2017. The vulnerability affects the MS Office component EQNEDT32.EXE

Encryption 91

Encryption Antivirus Malware Hacking 91

CyberSecurity Insiders

NOVEMBER 7, 2022

Computers are secure than smart phones – If that was the case, then why the former encountered more malware attacks in the year 2020-21 and why is that the latter is not been used for only communications. To avoid such threats, better to install anti-malware solutions and authenticator apps to keep online activity safe and secure.

VPN 115

VPN Mobile Password Management Malware 115

Security Affairs

OCTOBER 17, 2018

Yoroi security firm uncovered a targeted attack against one of the most important companies in the Italian Naval Industry leveraging MartyMcFly Malware. At a first sight, the office document had an encrypted content available on OleObj.1 And why the attacker used an encrypted payload if the victim cannot open it? 1 and OleObj.2.

Malware 85

Malware Computers and Electronics Encryption Penetration Testing 85

SecureList

OCTOBER 7, 2022

Using LOLBINS, common legitimate pentesting tools, and fileless malware; misleading security researchers by placing false flags—these and other anti-forensic tricks often make threat attribution a matter of luck. The malware spreads through spear-phishing emails with a malicious Microsoft Office document as attachment. PuzzleMaker.

Malware 143

Malware Computers and Electronics Telecommunications Encryption 143

SecureList

DECEMBER 1, 2023

To exfiltrate data and deliver next-stage malware, the attackers abuse cloud-based data storage, such as Dropbox or Yandex Disk, as well as a temporary file sharing service. libssl.dll or libcurl.dll was statically linked to implants to implement encrypted C2 communications. org domain did not occur in all cases.

Malware 98

Malware Ransomware Encryption Energy and Utilities 98

SecureList

MARCH 28, 2023

Although we have written about a similar malware attack in 2017 in one of our blogposts , the technique is still very relevant today as it doesn’t have any perfect solution from the perspective of operating system design. They were replicated and reused in other malware too. So does encrypting ransomware.

Cryptocurrency 107

Cryptocurrency Malware Banking Passwords 107

SecureList

APRIL 27, 2023

This framework has been used since at least since 2017, with active infections continuing. It is intended for cyber-espionage, and its features include keylogging, recording using the microphone, taking screenshots and stealing website passwords and email messages.

Energy and Utilities 137

Energy and Utilities Malware Government Manufacturing 137

SecureWorld News

JULY 13, 2023

Notably, the Equifax breach in 2017 was attributed to exploiting an unpatched vulnerability, highlighting the importance of timely updates and patches. Data Level: Encrypting sensitive data at rest and in transit is crucial to securing information.

Cybersecurity 83

Cybersecurity Data breaches Social Engineering Encryption 83

Security Affairs

JULY 8, 2023

Iran-linked APT group tracked TA453 has been linked to a new malware campaign targeting both Windows and macOS systems. The Iran-linked threat actor TA453 has been linked to a malware campaign that targets both Windows and macOS. GorjolEcho maintains persistence by copying the initial stages malware in a StartUp entry.

Malware 89

Malware VPN Media Encryption 89

SecureList

MAY 19, 2023

While there have been no updates about Prikormka or Operation Groundbait for a few years now, we discovered multiple similarities between the malware used in that campaign, CommonMagic and CloudWizard. The Crypton module performs encryption and decryption of all communications.

Encryption 96

Encryption Malware Internet Internet 96

Security Affairs

OCTOBER 9, 2022

In total, the database leaked over 152,000 pieces of information pertaining to customers, such as emails, names, links to LinkedIn, Twitter, and Facebook profiles, and hashed passwords. Some were protected by a fragile encryption algorithm like MD5, but others were encrypted using bcrypt, considered a strong hash.

Ransomware 90

Ransomware Passwords Encryption Identity Theft 90

Fox IT

MAY 4, 2021

In this post we provide some history, analysis and observations on this most pernicious family of banking malware targeting Oceania, the UK, Germany and Italy. Despite its long and rich history in the cyber-criminal underworld, the Gozi malware family is surrounded with mystery and confusion. Introduction.

Banking 98

Banking Malware Encryption Architecture 98

Krebs on Security

FEBRUARY 24, 2023

First identified in 2017 by the security firm Deep Instinct , Mylobot employs a number of fairly sophisticated methods to remain undetected on infected hosts, such as running exclusively in the computer’s temporary memory, and waiting 14 days before attempting to contact the botnet’s command and control servers.

Accountability 237

Accountability Advertising Marketing Malware 237

SecureWorld News

MARCH 24, 2022

Equifax data breach (2017). Summary: In 2017, an application vulnerability in one of their websites lead to the breach. What was compromised: names, email addresses, and passwords. They then gained access to a customer service database and uploaded malware to capture sensitive information. Records affected: 148 million.

Data breaches 114

Data breaches Passwords Accountability Government 114

CyberSecurity Insiders

JUNE 20, 2022

First is the gang that is distributing DeadBolt Ransomware, and the second is the malware variant dubbed QNAPCrypt. Cybersecurity researchers have found that the QNAP devices operating on weak passwords or operating outdated software are being targeted with the two said file-encrypting malware variants.

Cyber Attacks 96

Cyber Attacks Software Passwords Ransomware 96

Security Affairs

FEBRUARY 16, 2021

Latin American Javali trojan weaponizing Avira antivirus legitimate injector to implant malware. Javali trojan is active since November 2017 and targets users of financial and banking organizations geolocated in Brazil and Mexico. From here, the malware executes a new thread when specific and hardcoded web-browsers are opened.

Antivirus 113

Antivirus Malware Banking Internet 113

Elie

MARCH 31, 2019

Password Checkup. Password checkup allows users to check, in a privacy-preserving manner, whether their username and password matches one of the more than 4B+ credentials exposed by third-party data breaches of which Google is aware. Password Checkup help users mitigate this threat through a one-click, install and forget.

Passwords 87

Passwords Data breaches Accountability Internet 87

SecureList

MAY 25, 2021

From the massive outbreaks of 2017, such as WannaCry , NotPetya , and Bad Rabbit , a lot of ransomware actors have moved to the covert but highly profitable tactic of “big-game hunting” News of ransomware causing an outage of some global corporation’s services has now become commonplace. Introduction. Technical details.

Ransomware 106

Ransomware Encryption Malware Energy and Utilities 106

The Last Watchdog

JUNE 21, 2020

Although most people think of ransomware as a dodgy application that encrypts data and holds it for ransom, the concept is much more heterogeneous than that. The Archiveus Trojan from 2006 was the first one to use RSA cipher, but it was reminiscent of a proof of concept and used a static 30-digit decryption password that was shortly cracked.

Ransomware 243

Ransomware Hacking Encryption Penetration Testing 243

SecureList

AUGUST 8, 2022

Microsoft Word documents attached to the phishing emails contained malicious code that exploits the CVE-2017-11882 vulnerability. The vulnerability enables an attacker to execute arbitrary code (in the attacks analyzed, the main module of the PortDoor malware) without any additional user activity. Additional malware. Data theft.

Malware 91

Malware Phishing Passwords Data collection 91

CyberSecurity Insiders

NOVEMBER 7, 2022

Computers are secure than smart phones- If that was the case, then why the former encountered more malware attacks in the year 2020-21 and why is that the latter is not been used for only communications. To avoid such threats, better to install anti-malware solutions and authenticator apps to keep online activity safe and secure.

VPN 52

VPN Mobile Password Management Malware 52

Security Affairs

SEPTEMBER 15, 2018

Experts noticed the group since around mid-2016 when it was using PlugX, ChChes, Quasar and RedLeaves malware in targeted attacks. The ANEL malware was already seen in the previous attack as a beta version or release candidate. The body of the messages includes a password to use to see the password-protected document.

Media 80

Media Advertising Malware Phishing 80

Krebs on Security

APRIL 22, 2019

The owner of a Swedish company behind a popular remote administration tool (RAT) implicated in thousands of malware attacks shares the same name as a Swedish man who pleaded guilty in 2015 to co-creating the Blackshades RAT , a similar product that was used to infect more than half a million computers with malware, KrebsOnSecurity has learned.

Advertising 203

Advertising Antivirus Software Malware 203

SecureList

NOVEMBER 1, 2022

Since the malware in this incident was compiled on April 15, 2021, and compilation dates are the same for all known samples, this incident is likely to be the first involving Maui ransomware. This report included technical details of malware used in the campaign, such as Ecipekac, SodaMaster, P8RAT, FYAnti and QuasarRAT.

Malware 142

Malware Ransomware Spyware Encryption 142

SecureList

NOVEMBER 18, 2022

Rootkits are malware implants that are installed deep in the operating system. However, on one of the infected machines, we found malware that we think is probably related to CosmicStrand. This malware creates a user named “aaaabbbb” in the operating system with local administrator rights.

Malware 105

Malware Computers and Electronics Adware Cryptocurrency 105

Security Affairs

MAY 27, 2020

The updated Grandoreiro Malware equipped with latenbot-C2 features in Q2 2020 now extended to Portuguese banks. This piece of malware includes improvements in the way it is operating. The Grandoreiro malware has been distributed via malscan campaigns around the globe during Q2 2020. Technical Analysis. 100:51224/$rdgate?

Malware 65

Malware Banking Advertising Data collection 65

CyberSecurity Insiders

MAY 31, 2023

The malware combines several open-source projects to improve its capabilities. It has been historically associated with malicious activity performed by threat actors, APT groups (like in this Mandiant report from 2017), or government attacks (in this report by Unit42 in 2017). in March 2023, which is the most current version.

Malware 117

Malware Antivirus Encryption Advertising 117

Security Affairs

OCTOBER 1, 2019

The malware expert Marco Ramilli collected a small set of VBA Macros widely re-used to “weaponize” Maldoc (Malware Document) in cyber attacks. Here comes the idea to collect a small set of VBA Macros widely re-used to “weaponize” Maldoc (Malware Document) in contemporary cyber attacks. Set WinHttpReq = CreateObject("MSXML2.ServerXMLHTTP")

Malware 69

Malware Computers and Electronics Penetration Testing Cyber Attacks 69

SiteLock

OCTOBER 7, 2021

Back in 2017, a ransomware outbreak paralyzed several organizations in Russia and Ukraine, with cases also occurring in Turkey, Germany, Bulgaria and Japan. The malware became known as Bad Rabbit ransomware and was the third major spread of malware that year. Enforce strong password controls. Here’s a hint: not much.

Ransomware 52

Ransomware Passwords Malware Encryption 52

eSecurity Planet

AUGUST 14, 2023

As with other carte blanche, attackers can deploy malware at scale or perform espionage, but more dangerously, these power management consoles could be used to simply shut down the data centers entirely. All six critical vulnerabilities enabled RCE, and CVSS rated the flaws between 7.8 in severity.

Software 98

Software Malware Internet Internet 98

Security Boulevard

JUNE 15, 2023

Stealers" are a kind of malware designed to run on an endpoint post-compromise, while their primary features center on the theft of user data. Together with our colleagues at InQuest, we present a deep dive technical analysis of the malware. The same way you do in the real world – the market becomes flooded.

Cryptocurrency 52

Cryptocurrency Password Management Malware DNS 52