Remove Cybercrime Remove Information Security Remove Malware Remove System Administration
article thumbnail

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service called SocksEscort , which rents hacked residential and small business devices to cybercriminals looking to hide their true location online. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies.

Malware 205
article thumbnail

FIN7 cybercrime gang creates fake cybersecurity firm to recruit pentesters for ransomware attacks

Security Affairs

FIN7 is a Russian criminal group that has been active since mid-2015, it focuses on restaurants, gambling, and hospitality industries in the US to harvest financial information that was used in attacks or sold in cybercrime marketplaces. SecurityAffairs – hacking, cyber security). ” concludes the report.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

New iLOBleed Rootkit, the first time ever that malware targets iLO firmware

Security Affairs

The module has full access to all the firmware, hardware, software, and operating system installed on the server. . The attacks were spotted by Iranian cybersecurity firm Amnpardaz, this is the first time ever that malware targets iLO firmware. ” reads the report published by the expers. ” continues the report.

Firmware 132
article thumbnail

FBI and CISA published a new advisory on AvosLocker ransomware

Security Affairs

AvosLocker operators already advertised in the past a Linux variant, dubbed AvosLinux, of their malware claiming it was able to support Linux and ESXi servers. AvosLocker affiliates use legitimate software and open-source remote system administration tools to compromise the victims’ networks.

article thumbnail

A member of the FIN7 group was sentenced to 10 years in prison

Security Affairs

The Ukrainian national Fedir Hladyr (35), aka “das” or “AronaXus,” was sentenced to 10 years in prison for having served as a manager and systems administrator for the financially motivated group FIN7 , aka Carbanak. Between 2014 and 2016 the group used a new custom malware dubbed Carbanak that is considered a newer version of Anunak.

article thumbnail

Meet the Administrators of the RSOCKS Proxy Botnet

Krebs on Security

.” The DOJ’s statement doesn’t mention that RSOCKS has been in operation since 2014, when access to the web store for the botnet was first advertised on multiple Russian-language cybercrime forums. Kloster says he’s worked in many large companies in Omsk as a system administrator, web developer and photographer.

article thumbnail

StealthWorker botnet targets Synology NAS devices to drop ransomware

Security Affairs

. “Synology PSIRT (Product Security Incident Response Team) has recently seen and received reports on an increase in brute-force attacks against Synology devices. Synology’s security researchers believe the botnet is primarily driven by a malware family called “StealthWorker.” Pierluigi Paganini.