article thumbnail

Glupteba botnet is back after Google disrupted it in December 2021

Security Affairs

Researchers believe that at least five different merchants and exchanges were used to fund the Glupteba addresses since 2019. The experts used passive DNS records to uncover Glupteba domains and hosts and analyzed the latest set of TLS certificates used by the bot to figure out the infrastructure used by the attackers.

DNS 97
article thumbnail

Chinese-speaking cybercrime gang Rocke changes tactics

Security Affairs

The cybercrime organization was first spotted in April 2018 by researchers at Cisco Talos, earlier 2019 researchers from Palo Alto Networks Unit42 found new malware samples used by the Rocke group for cryptojacking that uninstalls from Linux servers cloud security and monitoring products developed by Tencent Cloud and Alibaba Cloud.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

A Deep Dive Into the Residential Proxy Service ‘911’

Krebs on Security

These two software are currently unknown to most if not all antivirus companies.” “Using the internal router, it would be possible to poison the DNS cache of the LAN router of the infected node, enabling further attacks.” The Exe Clean service made malware look like goodware to antivirus products.

VPN 304
article thumbnail

Satacom delivers browser extension that steals cryptocurrency

SecureList

Satacom downloader, also known as LegionLoader, is a renowned malware family that emerged in 2019. It is known to use the technique of querying DNS servers to obtain the base64-encoded URL in order to receive the next stage of another malware family currently distributed by Satacom. To do so, it performs a DNS request to don-dns[.]com

article thumbnail

Security Affairs newsletter Round 210 – News of the week

Security Affairs

Locked Shields 2019 – Chapeau, France wins Cyber Defence Exercise. CVE-2019-0803 Windows flaw exploited to deliver PowerShell Backdoor. Analyzing OilRigs malware that uses DNS Tunneling. Avast, Avira, Sophos and other antivirus solutions show problems after. Blue Cross of Idaho data breach, 5,600 customers affected.

article thumbnail

“FudCo” Spam Empire Tied to Pakistani Software Firm

Krebs on Security

The common acronym in nearly all of Saim Raza’s domains over the years — “FUD” — stands for “ F ully U n- D etectable,” and it refers to cybercrime resources that will evade detection by security tools like antivirus software or anti-spam appliances. FAIL BY NUMBERS.

Software 239
article thumbnail

Insider Threat and Mitigation Best Practices

CyberSecurity Insiders

This case exposed a vast list of Microsoft support records at the end of 2019. An employee is interested in things that lie outside the scope of his business duties. Insider threat cases . MICROSOFT DATABASE GOES PUBLIC . The scale was huge as the database contained approximately 250 million entries collected over 14 years.