Krebs on Security

DECEMBER 29, 2022

Here’s a look at some of the more notable cybercrime stories from the past year, as covered by KrebsOnSecurity and elsewhere. This bold about-face dumbfounded many longtime Norton users because antivirus firms had spent years broadly classifying all cryptomining programs as malware. agencies].

Cryptocurrency 308

Cryptocurrency Cybercrime Computers and Electronics Scams 308

Krebs on Security

MARCH 28, 2021

“web shells”) that various cybercrime groups worldwide have been using to commandeer any unpatched Exchange servers. Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. Just my Social Security number. I’d been doxed via DNS.

Hacking 363

Hacking Cybercrime DNS Internet 363

Security Affairs

APRIL 24, 2024

A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute backdoors and cryptocurrency miners. Avast researchers discovered and analyzed a malware campaign that exploited the update mechanism of the eScan antivirus to distribute backdoors and crypto miners.

Antivirus 132

Antivirus Malware DNS Cryptocurrency 132

Security Affairs

MAY 2, 2021

The bold author of a new cryptocurrency stealer, dubbed WeSteal, is promising its customers a leading way to make money in 2021. According to Palo Alto Networks, the author of WeSteal, that goes online as “ComplexCodes,” started advertising the cryptocurrency stealer on underground forums in mid-February 2021.

Cryptocurrency 117

Cryptocurrency Malware Advertising System Administration 117

Krebs on Security

MAY 13, 2024

This post examines the activities of Khoroshev’s many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years. was used by a Russian-speaking member called Pin on the English-language cybercrime forum Opensc. Dmitry Yuryevich Khoroshev.

Ransomware 312

Ransomware Cybercrime Accountability Malware 312

Security Affairs

OCTOBER 15, 2019

Chinese-speaking cybercrime gang Rocke that carried out several large-scale cryptomining campaigns, has now using news tactics to evade detection. Chinese-speaking cybercrime gang Rocke, that carried out several large-scale cryptomining campaigns in past , has now using news tactics to evade detection. Pierluigi Paganini.

Cybercrime 93

Cybercrime DNS Malware Advertising 93

SecureWorld News

JUNE 16, 2021

When it comes to hacking and cybercrime, sometimes all the focus is on the one who launches the attack. DOJ prosecutors say Oleg Koshkin, a 41-year-old Russian national, operated a crypting service used to conceal Kelihos malware from antivirus software. One of those threat actors was just convicted in a United States courtroom.

Antivirus 70

Antivirus Malware Software Ransomware 70

Krebs on Security

JULY 8, 2019

But GandCrab far eclipsed the success of competing ransomware affiliate programs largely because its authors worked assiduously to update the malware so that it could evade antivirus and other security defenses. ru , a site which marketed dedicated Web servers to individuals involved in various cybercrime projects. Vpn-service[.]us

Ransomware 278

Ransomware Accountability Cybercrime Passwords 278

Security Affairs

NOVEMBER 26, 2021

Morphisec researchers spread cryptocurrency malware dubbed Babadeda in attacks aimed at crypto and NFT communities. Morphisec researchers spotted a new crypto-malware strain, tracked as Babadeda, targeting cryptocurrency, non-fungible token (NFT), and DeFi passionates through Discord channels. ” concludes the report.

Cryptocurrency 144

Cryptocurrency Malware Antivirus Phishing 144

Security Affairs

DECEMBER 1, 2020

Microsoft warns of Vietnam-linked Bismuth group that is deploying cryptocurrency miner while continues its cyberespionage campaigns. Researchers from Microsoft reported that the Vietnam-linked Bismuth group, aka OceanLotus , Cobalt Kitty , or APT32 , is deploying cryptocurrency miners while continues its cyberespionage campaigns.

Cryptocurrency 137

Cryptocurrency Antivirus Manufacturing Government 137

SecureWorld News

JUNE 16, 2021

When it comes to hacking and cybercrime, sometimes all the focus is on the one who launches the attack. DOJ prosecutors say Oleg Koshkin, a 41-year-old Russian national, operated a crypting service used to conceal Kelihos malware from antivirus software. One of those threat actors was just convicted in a United States courtroom.

Antivirus 52

Antivirus Malware Software Ransomware 52

Security Affairs

MARCH 14, 2025

Panev received over $230,000 in laundered cryptocurrency from Khoroshev between 2022 and 2024. He developed the code to disable antivirus software, deploy malware, and print ransom notes to all printers connected to a victim network.

Ransomware 65

Ransomware Cryptocurrency Small Business Malware 65

Security Affairs

APRIL 14, 2019

The crooks used malicious emails purporting to be legitimate from such entities as Western Union, Norton AntiVirus and the IRS to spread the malware. SecurityAffairs – Romanian Duo, cybercrime). The spam messages used an attached file that once executed installed onto their computer. Pierluigi Paganini.

Cryptocurrency 111

Cryptocurrency Identity Theft Advertising Accountability 111

Security Affairs

JANUARY 7, 2021

Both exchanges are structured in a way that probably wouldn’t obligate them to comply with law enforcement requests and both were founded by Chinese nationals that moved their business to countries that are more friendly to cryptocurrency exchanges. ” concludes the report.

Ransomware 145

Ransomware Cryptocurrency Antivirus Banking 145

The Last Watchdog

SEPTEMBER 28, 2022

According to a new study, phishing attacks rose 61 percent in 2022, with cryptocurrency fraud increasing 257 percent year-over-year. Because the address comes across as an internal team member, people trust them, ultimately exposing themselves to cybercrime. Here are four new phishing trends keeping businesses on their toes.

Phishing 124

Phishing Scams Cybercrime Passwords 124

Security Affairs

NOVEMBER 15, 2021

The trojan allows to hijack users’ mobile devices and steal funds from online banking and cryptocurrency accounts. At the time of writing, SharkBot appears to have a very low detection rate by antivirus solutions since. login credentials, personal information, current balance, etc.).

Banking 144

Banking Mobile Social Engineering Malware 144

Webroot

OCTOBER 4, 2024

Cryptojacking : Hides on your device and steals its computing resources to mine cryptocurrencies like Bitcoin. So how do we protect ourselves from this type of cybercrime? Use antivirus software like Webroot Premium to protect all your devices. If malware goes undetected, your devices can become locked or unstable.

Malware 115

Malware Backups Adware Ransomware 115

Security Affairs

JUNE 1, 2025

Czech Republic accuses China’s APT31 of a cyberattack on its Foreign Ministry New PumaBot targets Linux IoT surveillance devices App Store Security: Apple stops $2B in fraud in 2024 alone, $9B over 5 years Crooks use a fake antivirus site to spread Venom RAT and a mix of malware Iranian Man pleaded guilty to role in Robbinhood Ransomware attacks (..)

61

61

Security Affairs

AUGUST 21, 2022

The loader is also designed to gather system information, retrieve a list of installed antivirus solutions, cryptocurrency wallets, banking, and mail apps, and exfiltrate the information to a remote server. That’s not all. Grandoreiro is a continuously evolving threat that represents a serious threat to organizations worldwide.

Banking 108

Banking Malware Antivirus Phishing 108

Security Affairs

FEBRUARY 19, 2023

Twitter will allow using the SMS-based two-factor authentication (2FA) only to its Blue subscribers GoDaddy discloses a new data breach Fortinet fixes critical vulnerabilities in FortiNAC and FortiWeb German airport websites hit by DDos attacks once again Cisco fixed critical RCE bug in ClamAV Open-Source Antivirus engine CISA adds Cacti, Office, Windows (..)

DDOS 98

DDOS Data breaches Ransomware Hacking 98

Security Affairs

JULY 3, 2023

“What’s more concerning is that a large portion of antivirus software has proven ineffective against the Meduza stealer binary, either failing to detect it statically or dynamically” reads the analysis published by Uptycs. ” The administrator offers access to the stolen data through a management console.

Password Management 98

Password Management Passwords Malware Marketing 98

Security Affairs

NOVEMBER 19, 2019

To bypass antivirus systems, hackers send out malicious emails in non-working hours with delayed activation. Another technique used by cybercriminals to bypass antivirus systems is a targeted attack, in which malicious email are delivered outside regular working hours. More than 80% of all malicious files were disguised as .zip

Ransomware 99

Ransomware Antivirus Malware Banking 99

Security Affairs

AUGUST 15, 2023

“To avoid detection by antivirus software, the RAT employs command and control functionality through a Telegram bot. The malware includes a clipper code to capture data copied to the clipboard, a technique used to extract cryptocurrency wallet information from Monero, Ethereum, and Bitcoin.

Malware 98

Malware Antivirus Cryptocurrency Advertising 98

Security Affairs

AUGUST 21, 2022

The scripts will also infect the victim’s computer with the Raccoon Stealer info-stealing trojan which allows operators to steal login credentials, cookies, auto-fill data, and credit cards saved on web browsers, along with cryptocurrency wallets.

DDOS 98

DDOS Malware Antivirus Firewall 98

Security Affairs

JULY 30, 2018

Malware researchers at Proofpoint spotted a new version of the AZORult Spyware in the wild, it was involved in a large email campaign on July 18, just 24 hours it appeared in cybercrime forums on the Dark Web. The experts attributed the campaign to the TA516 threat actor that was focused on cryptocurrencies. com/soft.exe. ransomware.

Spyware 72

Spyware Cryptocurrency Passwords Malware 72

Security Affairs

DECEMBER 19, 2022

The botnet was involved in stealing users’ credentials and data, mining cryptocurrencies abusing victims’ resources, and setting up proxies to funnel other people’s internet traffic through infected machines and routers. Botnet operators use to spread the malware via cracked or pirated software and pay-per-install (PPI) schemes. .

DNS 112

DNS Antivirus Cryptocurrency Software 112

Security Affairs

APRIL 29, 2023

ViperSoftX is a JavaScript-based Remote Access Trojan (RAT) and cryptocurrency stealer that was first analyzed by Fortinet in February 2020. ViperSoftX also checks for active antivirus products running on the machine. ” reads the analysis published by Trend Micro. ” concludes the report.

Encryption 98

Encryption Malware Cryptocurrency Software 98

Security Affairs

AUGUST 28, 2019

In recent campaigns, the Retadup worm was observed delivering Monero cryptocurrency miners in Latin America. Earlier this year, malware researchers from Avast antivirus firm discovered a design flaw in the C&C protocol of the botnet that could have been exploited to remove the malware from infected computers.

Malware 111

Malware Advertising Antivirus Cryptocurrency 111

Security Affairs

MARCH 29, 2023

The experts were not able to determine the amount of Monero cryptocurrencies stolen by the threat actors due to the privacy features supported by the cryptocurrency scheme. “A mistake likely made by all victims of this malware was to download and run Tor Browser from a third-party resource. ” concludes the report.

Malware 98

Malware Passwords Cryptocurrency Antivirus 98

SecureWorld News

AUGUST 8, 2022

It has been sold on underground hacker forums for stealing browser data, user credentials, and cryptocurrency information. LokiBot LokiBot is a Trojan malware for stealing sensitive information, including user credentials, cryptocurrency wallets, and other credentials. AZORult's developers are constantly updating its capabilities.

Malware 98

Malware Banking Penetration Testing Healthcare 98

Security Affairs

OCTOBER 31, 2022

In the early afternoon of Friday 12 May 2017, the media broke the news of a global computer security attack carried out through a malicious code capable of encrypting data residing in information systems and demanding a ransom in cryptocurrency to restore them, the Wannacry ransomware. About the author: Salvatore Lombardo.

Malware 112

Malware Computers and Electronics Encryption Ransomware 112

Security Affairs

JULY 19, 2019

The Rubella Macro Builder is cheap, fast and easy to use, the malware it generated can evade antivirus detection. The police also seized around 20,000 Euro (around $22,000) in cryptocurrency such as Bitcoins. . The macro might also purposely attempt to bypass endpoint security defenses. .

Malware 99

Malware Social Engineering Advertising Antivirus 99

SecureList

APRIL 10, 2023

The most popular application categories to hide malware and unwanted software include cryptocurrency trackers, financial apps, QR-code scanners and even dating apps. Malware and unwanted software is frequently injected into cryptocurrency trackers, financial apps, QR-code scanners and even dating apps.

Malware 133

Malware Encryption Mobile Accountability 133

Security Affairs

SEPTEMBER 5, 2022

While previous variants of the dropper relied on Accessibility permissions to automatically install the Sharkbot malware, this new one asks the victim to install the malware as a fake update for the antivirus. The trojan allows to hijack users’ mobile devices and steal funds from online banking and cryptocurrency accounts.

Banking 100

Banking Malware Mobile Accountability 100

SecureList

SEPTEMBER 6, 2022

Once executed on the attacked system, RedLine Stealer collects system information, including device user names, the operating system type, and information about the hardware, installed browsers, and antivirus solutions. Once a miner file is launched on an affected computer, it starts using the machine’s energy to mine cryptocurrency.

Mobile 131

Mobile Passwords Software Accountability 131

eSecurity Planet

FEBRUARY 16, 2021

For access to the decryption key, the victim must make prompt payment, often in cryptocurrency shielding the attacker’s identity. This is especially true for your existing intrusion detection and prevention system (IDPS), antivirus, and anti-malware. Bitdefender : Bitdefender Antivirus Plus. Offline Backups. Description.

Ransomware 97

Ransomware Backups Software Encryption 97

Digital Shadows

NOVEMBER 26, 2024

The proliferation of cybercrime guides on forums and a 7% rise in insider threat content, driven by significant financial incentives, highlight the growing complexity of cybersecurity challenges. The proliferation of these guides enables more individuals to enter the cybercrime arena.

Cyber Attacks 59

Cyber Attacks Phishing Ransomware Cyber Insurance 59