Graham Cluley

DECEMBER 22, 2022

The FBI is warning US consumers that cybercriminals are placing ads in search engine results that impersonate well-known brands, in an attempt to spread ransomware and steal financial information. Read more in my article on the Tripwire State of Security blog.

Engineering 106

Engineering Ransomware Advertising Phishing 106

Heimadal Security

MARCH 15, 2021

A new botnet malware is hunting down and transforming infected routers, DVRs, and UPnP network devices into honeypots. The malware was named ZHtrap by the 360 Netlab, the security researchers that spotted it. The post ZHtrap Botnet Malware Deploys Honeypots in the Search for More Targets appeared first on Heimdal Security Blog.

Malware 69

Malware DDOS Cybersecurity 69

Heimadal Security

MARCH 2, 2023

Two separate threat campaigns targeted six different law firms in January and February 2023, distributing GootLoader and FakeUpdates, also known as SocGholish malware. GootLoader is a first-stage downloader capable of delivering a wide range of secondary payloads such as Cobalt Strike and ransomware and has been active since late 2020.

Malware 94

Malware Ransomware Cybersecurity 94

Heimadal Security

DECEMBER 29, 2022

Google Ads have become increasingly used by malware operators to spread malware to unsuspecting users searching for popular software products. The post Google Ads Exploited to Spread Malware appeared first on Heimdal Security Blog. By cloning the official websites of the above projects, threat actors […].

Malware 82

Malware Software Cybersecurity 82

Heimadal Security

JANUARY 12, 2023

Recently, Australian hospitals have been hit by a wave of Gootkit malware loader attacks that leverage legitimate software like VLC Media Player as cover. To get initial access, Gootkit (also known as Gootloader) is reported to use search engine optimization (SEO) poisoning techniques.

Healthcare 83

Healthcare Malware Media Engineering 83

Malwarebytes

JANUARY 31, 2024

Nitrogen is the name given to a campaign and associated malware that have been distributed via malicious search ads. In this blog post, we look at a recent Nitrogen campaign and specifically at how the initial payload is being served onto victims.

Malware 80

Malware Hacking System Administration Ransomware 80

Heimadal Security

NOVEMBER 2, 2022

For the past week, upon searching for ‘GIMP’ on Google, visitors would be shown an ad for ‘GIMP.org,’ the official website of the graphics editor. The post Google Ad Exploited to Deliver Infostealing Malware appeared first on Heimdal Security Blog. The 700 MB executable pretending […].

Malware 90

Malware Phishing Cybersecurity 90

Krebs on Security

JUNE 1, 2023

This post is a deep dive on “ Megatraffer ,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015. More recently, it appears Megatraffer has been working with ransomware groups to help improve the stealth of their malware. WHO IS MEGATRAFFER?

Malware 242

Malware Cybercrime Software Antivirus 242

Krebs on Security

MAY 18, 2020

Almost daily now there is news about flaws in commercial software that lead to computers getting hacked and seeded with malware. Here’s a look at one long-lived malware vulnerability testing service that is used and run by some of the Dark Web’s top cybercriminals. RedBear’s profile on the Russian-language xss[.]is

Malware 314

Malware Cybercrime Ransomware Marketing 314

Security Affairs

MARCH 2, 2023

Cyber criminals are targeting law firms with GootLoader and FakeUpdates (aka SocGholish) malware families. The firms were targeted as part of two distinct campaigns aimed at distributing GootLoader and FakeUpdates (aka SocGholish) malware. One campaign attempted to infect law firm employees with the GootLoader malware.

Malware 81

Malware Ransomware Engineering Internet 81

SecureWorld News

NOVEMBER 14, 2022

In an effort to increase their Google search rankings and drive more traffic to fake sites, bad actors are employing a black hat SEO trick that is redirecting users via WordPress websites. Visitors to the more than 15,000 websites are being redirected to low-quality bogus Q&A sites thanks to malware infecting the WordPress sites.

Malware 77

Malware Cryptocurrency Engineering Authentication 77

McAfee

SEPTEMBER 20, 2021

The Real-Time Search feature in MVISION EDR provides the ability to search across your environment for behavior associated with the exploitation of this Microsoft vulnerability. Using Historical Search to locate IOCs across all devices. Signature 6153: Malware Behavior: Ryuk Ransomware activity detected.

Ransomware 110

Ransomware Engineering Internet Internet 110

Security Affairs

MAY 1, 2023

The previously undetected LOBSHOT malware is distributed using Google ads and gives operators VNC access to Windows devices. Threat actors are using an elaborate scheme of fake websites through Google Ads to spread their malware, the backdoors are embedded in installers for apparently legitimate applications, such as AnyDesk.

Malware 87

Malware Cybercrime Banking Software 87

Malwarebytes

APRIL 1, 2021

A newly discovered piece of Android malware shares the same capabilities found within many modern stalkerware-type apps—it can swipe images and video, rifle through online searches, record phone calls and video, and peer into GPS location data—but the infrastructure behind the malware obscures its developer’s primary motivations.

Malware 145

Malware Spyware Advertising Surveillance 145

Krebs on Security

APRIL 9, 2024

Only three of April’s vulnerabilities earned Microsoft’s most-dire “critical” rating, meaning they can be abused by malware or malcontents to take remote control over unpatched systems with no help from users. Tempering the sheer volume of this month’s patches is the middling severity of many of the bugs.

DNS 241

DNS Social Engineering Malware Media 241

Malwarebytes

APRIL 9, 2024

The malicious ads are displayed as sponsored results on Google’s search engine page and localized to North America. Victims are tricked into downloading and running the Nitrogen malware masquerading as a PuTTY or FileZilla installer. We have reported this campaign to Google but no action has been taken yet. dll (Nitrogen).

System Administration 106

System Administration DNS Engineering Social Engineering 106

Malwarebytes

SEPTEMBER 27, 2023

In February 2023, Microsoft disclosed its new AI-assisted search engine, Bing Chat, powered by OpenAI's GPT-4. Even though Google has been dominating the search industry for years, this event was significant enough to generate not only interest but also plant the seed for a possible change in the balance in the future.

Malware 144

Malware Software Advertising Engineering 144

Lenny Zeltser

JANUARY 6, 2021

Malware analysis sits at the intersection of incident response, forensics, system and network administration, security monitoring, and software engineering. As someone who’s helped thousands of security professionals learn how to analyze malware at SANS Institute , I have a few tips for how you can get started.

Malware 145

Malware Software Engineering Information Security 145

SiteLock

AUGUST 27, 2021

Maybe you want to dive into the world of malware and learn more about what it is and how it can be prevented. There is a lot of information on the web on this subject and with 155 SiteLock blogs published in 2018 alone–that’s a lot content to search through! Join us as we countdown the top 10 most popular SiteLock blogs in 2018!

Malware 52

Malware IoT Cybersecurity Software 52

Heimadal Security

MARCH 3, 2021

SEO, known as Search Engine Optimization is used by webmasters in a legitimate way and aims to increase a website’s exposure on different search engines, like Google or Bing, but now it looks like threat actors are tampering with the content management systems of websites in order to be able to serve financial malware, exploit […].

Malware 90

Malware Engineering Ransomware Cybersecurity 90

Security Affairs

JUNE 3, 2022

An “extremely sophisticated” China-linked APT tracked as LuoYu was delivering malware called WinDealer via man-on-the-side attacks. The activity of the group was first documented by TeamT5 researchers that also reported the use of three malware families: SpyDealer, Demsty and WinDealer. To nominate, please visit:?.

Malware 132

Malware Telecommunications Internet Internet 132

Malwarebytes

APRIL 4, 2024

Most of the malicious search ads we have seen have originated from Google, but threat actors are also abusing other search engines. In this blog post, we look at a very recent malvertising campaign impersonating the popular VPN software NordVPN. The file contains both an installer for NordVPN and a malware payload.

VPN 102

VPN Advertising DNS Malware 102

Heimadal Security

DECEMBER 7, 2021

Nobelium is a Russian-backed advanced persistent threat (APT) organization that achieved attention towards the end of 2020 after breaching SolarWinds’ software development supply chain to obtain access to espionage targets, and it continues to deploy creative approaches in its search for new victims. What Happened?

Malware 87

Malware Government Software Hacking 87

SecureBlitz

MARCH 2, 2021

Due to Gootkit RAT, Hackers can now exploit websites to give them excellent SEO before deploying malware. Sophos reported that the said method of search engine “deoptimization” includes both search engine optimization tricks and the human psychology abuse to push compromised sites to the rankings of Google.

Malware 63

Malware Engineering Cybersecurity Ransomware 63

Heimadal Security

JUNE 15, 2021

Microsoft noticed a wave of cyberattacks that use SEO poisoning, also known as search poisoning, to deliver a remote access trojan (RAT) employed by cybercriminals to steal private information from the infected systems.

Malware 68

Malware Engineering Cybersecurity 68

SiteLock

AUGUST 27, 2021

Searching for content within a database can be a little trickier than searching files, but the options are pretty similar. Following up on last week’s blog titled, “ How to Look for Malware in your Website Files ” we talk about how to look for malware in databases and what types of things you should be looking for.

Malware 98

Malware Risk Hacking Engineering 98

Security Affairs

MAY 3, 2022

A China-linked APT group, tracked as Moshen Dragon, has been observed targeting the telecommunication sector in Central Asia with ShadowPad and PlugX malware, SentinelOne warns. Both PlugX and ShadowPad malware are very common among China-linked cyberespionage groups. ” concludes the report.”Once To nominate, please visit:?

Software 104

Software Malware Telecommunications Antivirus 104

Heimadal Security

JUNE 18, 2021

The post Vigilante Malware Rejects Software Pirates and Blocks Them appeared first on Heimdal Security Blog. Unfortunately, the […].

Software 64

Software Malware Media Cybersecurity 64

Krebs on Security

NOVEMBER 28, 2022

But that story omitted an important historical detail about Pushwoosh: In 2013, one of its developers admitted to authoring the Pincer Trojan , malware designed to surreptitiously intercept and forward text messages from Android mobile devices. ” wherein Shmakov acknowledged writing the malware as a freelance project.

Mobile 240

Mobile Malware Technology Government 240

Security Affairs

MAY 7, 2022

Experts spotted a malware campaign that is the first one using a technique of hiding a shellcode into Windows event logs. The experts discovered that the attackers are hiding encrypted shellcode containing the next-stage malware as 8KB pieces in event logs. The code is quite unique, with no similarities to known malware.

Malware 85

Malware Encryption Hacking Cybersecurity 85

Malwarebytes

DECEMBER 1, 2021

The particular malicious apps the ThreatFabric researchers found were disguised to look like apps that an Android user might normally search for, such as QR scanners, PDF scanners, cryptocurrency wallets, and fitness monitors. ” In four months, four Android malware families have spread across the Google Play Store.

Malware 120

Malware Banking Authentication Cryptocurrency 120

SC Magazine

MARCH 19, 2021

Researchers disrupted a newly documented Chinese-based malware called CopperStealer that, since significant countermeasures started in late January, infected up to 5,000 individual hosts per day, stealing credentials of users on major platforms including Facebook, Instagram, Apple, Amazon, Bing, Google, PayPal, Tumblr and Twitter.

Malware 113

Malware Media Passwords Accountability 113

Security Affairs

JANUARY 16, 2022

Microsoft spotted a new destructive malware operation targeting government, non-profit, and IT entities in Ukraine. At present and based on Microsoft visibility, our investigation teams have identified the malware on dozens of impacted systems and that number could grow as our investigation continues.”. ” reported Reuters.

Malware 101

Malware Government Ransomware Encryption 101

Malwarebytes

JANUARY 25, 2024

An ongoing campaign of malicious ads has been targeting Chinese-speaking users with lures for popular messaging applications such as Telegram or LINE with the intent of dropping malware. Many Google services, including Google search, are also either restricted or heavily censored in mainland China. Malicious ads Visitors to google.cn

Malware 103

Malware Advertising Accountability Encryption 103

Malwarebytes

AUGUST 23, 2023

Upon analysis and comparison, we determined that this sample was an updated version of DarkGate, a multi purpose malware toolkit first identified in 2018. The campaigns we observed coincide with an announcement from DarkGate's developer in June as well, boasting about the malware's new capabilities and limited customer seats.

Engineering 97

Engineering Malware Encryption Advertising 97

Malwarebytes

FEBRUARY 28, 2024

The most recent targeted searches are for Parsec and FreeCad, followed by WinSCP, Advanced IP Scanner, Slack and Notion. One other malware family we have seen here and there is Rhadamanthys. In this blog post, we detail the latest distribution chain related to this malware. link cerisico[.]net net notione.my-apk[.]com

Advertising 76

Advertising Malware Software DNS 76

Security Affairs

NOVEMBER 14, 2022

Since September 2022, researchers from security firm Sucuri have tracked a surge in WordPress malware redirecting website visitors to fake Q&A sites via ois[.]is. “Some website malware infections limit themselves to a small number of files, often to limit their footprint and avoid detection. wp-blog-header.php.

Malware 84

Malware Hacking Engineering Information Security 84