article thumbnail

Meet the Administrators of the RSOCKS Proxy Botnet

Krebs on Security

” The DOJ’s statement doesn’t mention that RSOCKS has been in operation since 2014, when access to the web store for the botnet was first advertised on multiple Russian-language cybercrime forums. Even today, the RUSdot Mailer is advertised for sale at the top of the RUSdot community forum.

article thumbnail

Active Nitrogen campaign delivered via malicious ads for PuTTY, FileZilla

Malwarebytes

In the past couple of weeks, we have observed an ongoing campaign targeting system administrators with fraudulent ads for popular system utilities. We have observed several different advertiser accounts which were all reported to Google. The lures are utilities commonly used by IT admins such as PuTTY and FileZilla.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

FBI and CISA published a new advisory on AvosLocker ransomware

Security Affairs

AvosLocker operators already advertised in the past a Linux variant, dubbed AvosLinux, of their malware claiming it was able to support Linux and ESXi servers. AvosLocker affiliates use legitimate software and open-source remote system administration tools to compromise the victims’ networks.

article thumbnail

Cisco fixed a critical issue in the Unified Contact Center Express

Security Affairs

The issue could be exploited by supplying a malformed Java object to a specific listener on an vulnerable system. Administrators should update their Unified CCE installs as soon as possible. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

article thumbnail

Orcus RAT Author Charged in Malware Scheme

Krebs on Security

An advertisement for Orcus RAT. The accused, 36-year-old John “Armada” Revesz , has maintained that Orcus is a legitimate “ R emote A dministration T ool” aimed at helping system administrators remotely manage their computers, and that he’s not responsible for how licensed customers use his product.

Malware 200
article thumbnail

Malvertiser copies PC news site to deliver infostealer

Malwarebytes

This type of website is often visited by geeks and system administrators to read the latest computer reviews, learn some tips and download software utilities. The advertiser shows as Scott Cooper and is likely a compromised or fake identity. One common technique used by threat actors to evade detection is to employ cloaking.

Software 137
article thumbnail

Cisco fixes a static default credential issue in Smart Software Manager tool

Security Affairs

“The vulnerability is due to a system account that has a default and static password and is not under the control of the system administrator.” ” An attacker could exploit the flaw by using this default account to connect to a vulnerable system and obtain read and write access to system data.

Software 110