SecureList

SEPTEMBER 21, 2023

DDoS ads distributed by month, H1 2023 ( download ) The price of a service like that is driven by numerous factors that determine attack complexity, such as DDoS protection, CAPTCHA, and JavaScript verification on the victim’s side. DNS changer Malicious actors may use IoT devices to target users who connect to them.

IoT 92

IoT DDOS Passwords Malware 92

Security Affairs

MAY 13, 2019

Section 3 describes the “ blocked attacks ” through Yoroi DNS protection during the year, while Section 4 describe Dark-Net activities observed by our researchers. Download the Yoroi Cyber Security Report 2018. Section 2 reports observed data from the attacks surface focusing on IP addresses analysis and ASNs involved in the attacks.

Malware 76

Malware Advertising DNS Surveillance 76

Security Affairs

JULY 7, 2019

China installs a surveillance app on tourists phones while crossing in the Xinjiang. Updates for Samsung, the scam app with 10M+ downloads. Godlua backdoor, the first malware that abuses the DNS over HTTPS (DoH). Firefox finally addressed the Antivirus software TLS Errors. LooCipher: The New Infernal Ransomware.

Scams 47

Scams Spyware DNS Advertising 47

SecureList

OCTOBER 26, 2021

In June, more than six months after DarkHalo had gone dark, we observed the DNS hijacking of multiple government zones of a CIS member state that allowed the attacker to redirect traffic from government mail servers to computers under their control – probably achieved by obtaining credentials to the control panel of the victims’ registrar.

Malware 143

Malware Government Surveillance Spyware 143

Malwarebytes

MARCH 29, 2021

Your phone traffic is routed through the tunnel, where it’s protected from surveillance, before joining the internet. Whilst lots of web pages are served over HTTPS (the secure form of HTTP) many are not, and most DNS lookups—which reveal the names of the websites you’re visiting—are vulnerable to snooping.

VPN 112

VPN Mobile Internet Internet 112

Malwarebytes

MAY 9, 2023

Although the infection chain is similar to what was already reported, the attackers were using a slightly different process back in 2020: OP#1 Infection phase An MSI file is downloaded from hxxp://91.234.33.185/f8f44e5de5b4d954a83961e8990af655/update.msi. MSI files usage is a known signature from the group. Note the common pattern in urls.

Surveillance 75

Surveillance Accountability DNS Encryption 75

SecureList

MAY 31, 2021

Judging from the main features of the P8RAT and SodaMaster backdoors, we believe these modules are downloaders responsible for downloading further malware which we have so far been unable to obtain. It then downloads and installs the miner. The sample extracts a URL from the “downloadURL” field for the next download.

Malware 101

Malware Adware Encryption Architecture 101

SecureList

NOVEMBER 26, 2021

The attackers obtain initial access to a system by sending a spear-phishing email to the victim containing a Dropbox download link. If the victim opens the document, Microsoft Office downloads the script and runs it using the MSHTML engine. After this, they were tricked into downloading previously unknown malware.

Malware 92

Malware Banking Energy and Utilities Accountability 92

SecureList

APRIL 27, 2022

We have previously seen DustSquad use third-party post-exploitation tools, such as the password dumping utility fgdump; but we have now observed new custom C modules, a first for DustSquad, and Delphi downloaders acting as post-exploitation facilitators, able to gather documents of interest for the actor.

Malware 135

Malware Firmware Government Phishing 135

SecureList

APRIL 27, 2021

Although Lyceum still prefers taking advantage of DNS tunneling, it appears to have replaced the previously documented.NET payload with a new C++ backdoor and a PowerShell script that serve the same purpose. Our telemetry revealed that the threat group’s latest endeavors are focused on going after entities within one country – Tunisia.

Malware 142

Malware Spyware Government Social Engineering 142