article thumbnail

DirtyMoe botnet infected 100,000+ Windows systems in H1 2021

Security Affairs

DirtyMoe is a Windows botnet that is rapidly growing, it passed from 10,000 infected systems in 2020 to more than 100,000 in the first half of 2021. Experts pointed out that the number of infected systems could be far greater because data provided by AVAST are only related to systems running their antivirus solution.

DNS 135
article thumbnail

Crackonosh Monero miner made $2M after infecting 222,000 Win systems

Security Affairs

“While the Windows system is in safe mode antivirus software doesn’t work. The researchers started investigating the threat after they became aware that the malware was disabling and uninstalling its antivirus from infected devices. “It also uses WQL to query all antivirus software installed SELECT * FROM AntiVirusProduct.”

Antivirus 115
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Ad blocker with miner included

SecureList

Back then, cybercriminals distributed malware under the guise of the Malwarebytes antivirus installer. After substituting the DNS servers, the malware starts updating itself by running update.exe with the argument self-upgrade (“C:Program Files (x86)AdShieldupdater.exe” -self-upgrade). Distributed under the name adshield[.]pro,

DNS 144
article thumbnail

No, I Did Not Hack Your MS Exchange Server

Krebs on Security

Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. I first heard about the domain in December 2020, when a reader told me how his entire network had been hijacked by a cryptocurrency mining botnet that called home to it. I’d been doxed via DNS.

Hacking 357
article thumbnail

Highly Sophisticated Malware Attacks Home and Small Office Routers

eSecurity Planet

According to Lumen’s Black Lotus Labs, this sophisticated campaign “has been active in North America and Europe for nearly two years beginning in October 2020.”. The attacks include ZuoRAT, a multi-stage remote access Trojan (RAT) that specifically exploits known vulnerabilities in SOHO routers to hijack DNS and HTTP traffic.

Malware 117
article thumbnail

Stories from the SOC: Fighting back against credential harvesting with ProofPoint

CyberSecurity Insiders

Executive summary Credential harvesting is a technique that hackers use to gain unauthorized access to legitimate credentials using a variety of strategies, tactics, and techniques such as phishing and DNS poisoning. of cases in 2020. Running an antivirus scan on the asset. Blocking the URL domain and IP.

article thumbnail

Could allowlisting reduce the impact of ransomware, cyberattacks on health care?

SC Magazine

29, 2020, in Houston. Between the DNS attacks and ongoing ransomware scourge, it’s beyond time for providers to seek more creative responses to cyber challenges even with limited budgets, in combination with participation in threat-sharing programs and while relying on free or low-cost resources. Photo: Go Nakamura/Getty Images).