article thumbnail

Disneyland Malware Team: It’s a Puny World After All

Krebs on Security

A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode , an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic. Bank customers. Bank customers.

Malware 278
article thumbnail

Thinking of Hiring or Running a Booter Service? Think Again.

Krebs on Security

Most people who operate DDoS-for-hire businesses attempt to hide their true identities and location. Proprietors of these so-called “booter” or “stresser” services — designed to knock websites and users offline — have long operated in a legally murky area of cybercrime law. Image: archive.org.

DDOS 226
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

Krebs on Security

In 2020, the United States brought charges against four men accused of building a bulletproof hosting empire that once dominated the Russian cybercrime industry and supported multiple organized cybercrime groups. From January 2005 to April 2013, there were two primary administrators of the cybercrime forum Spamdot (a.k.a

article thumbnail

Russian-speaking cybercrime evolution: What changed from 2016 to 2021

SecureList

Having been in the field for so long, we have witnessed some major changes in the cybercrime world’s modus operandi. This report shares our insights into the Russian-speaking cybercrime world and the changes in how it operates that have happened in the past five years. The year 2016 saw banks in Russia hacked one after another.

article thumbnail

Fake DDoS protection pages on compromised WordPress sites lead to malware infections

Security Affairs

Threat actors compromise WordPress sites to display fake Cloudflare DDoS protection pages to distribute malware. DDoS Protection pages are associated with browser checks performed by WAF/CDN services which verify if the site visitor is a human or a bot. The file poses as a tool required to bypass the DDoS verification.

DDOS 88
article thumbnail

BitRAT campaign relies on stolen sensitive bank data as a lure

Security Affairs

Experts warn of a new malware campaign using sensitive information stolen from a bank as a lure to spread the remote access trojan BitRAT. Qualys experts spotted a new malware campaign spreading a remote access trojan called BitRAT using sensitive information stolen from a bank as a lure in phishing messages. Keylogging. Monero mining.

Banking 85
article thumbnail

Law enforcement worldwide hunting users of DDoS-for-Hire services

Security Affairs

Europol and law enforcement agencies worldwide are investigating DDoS-for-hire services and hunting users that paid them to carry out cyber attacks. The operation dubbed Power Off allowed to shut down the biggest DDoS-for-hire service ( webstresser.org ) and arrest its administrators. webstresser.org.

DDOS 85