Krebs on Security

DECEMBER 3, 2024

Interisle sources data about cybercrime domains from anti-spam organizations, including the Anti-Phishing Working Group (APWG), the Coalition Against Unsolicited Commercial Email (CAUCE), and the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG). By comparison, the cheapest price identified for a.com domain was $5.91.

Cybercrime 295

Cybercrime Phishing Accountability Internet 295

eSecurity Planet

MAY 11, 2025

Technical support consultant using programming to upgrade artificial intelligence simulation model As AI tools boom in popularity, cyberthieves are exploiting the excitement with fake AI video editing platforms that lure users into downloading malware. The Noodlophile Stealer is a new malware strain. Credit: Morphisec Whos behind it?

Malware 106

Malware Scams Media Artificial Intelligence 106

Malwarebytes

MARCH 17, 2025

Instead of converting files, the tools actually load malware onto victims computers. The FBI warned specifically about that malware leading to ransomware attacks, but we’ve also seen similar sites that install browser hijackers, adware, and potentially unwanted programs (PUPs). This is the actual malware. Imageconvertors[.]com

Malware 140

Malware Adware Education Phishing 140

Security Affairs

JANUARY 16, 2025

Researchers discovered a 13,000-device MikroTik botnet exploiting DNS flaws to spoof 20,000 domains and deliver malware. Infoblox researchers discovered a botnet of 13,000 MikroTik devices that exploits DNS misconfigurations to bypass email protections, spoof approximately 20,000 domains, and deliver malware.

DNS 139

DNS Malware Firmware Authentication 139

Malwarebytes

JANUARY 16, 2025

The FBI says it has removed PlugX malware from thousands of infected computers worldwide. The move came after suspicion that cybercriminals groups under control of the Peoples Republic of China (PRC) used a version of PlugX malware to control, and steal information from victims’ computers.

Malware 122

Malware DNS Internet Internet 122

Krebs on Security

MARCH 17, 2022

The group also is tracking several code packages that were recently modified to erase files on computers that appear to be coming from Russian or Belarusian Internet addresses. For example, the popular library ES5-ext hadn’t updated its code in nearly two years. The message has been Google-Translated from Russian to English.

Malware 359

Malware Internet Internet Software 359

Krebs on Security

AUGUST 2, 2022

With the recent demise of several popular “proxy” services that let cybercriminals route their malicious traffic through hacked PCs, there is now something of a supply chain crisis gripping the underbelly of the Internet. com , a malware-based proxy network that has been in existence since at least 2010.

Malware 320

Malware Cybercrime Internet Internet 320

Krebs on Security

NOVEMBER 12, 2024

.” McCarthy also pointed to CVE-2024-43498 , a remote code execution flaw in.NET and Visual Studio that could be used to install malware. Any one of these bugs could be used to install malware if an authenticated user connects to a malicious or hacked SQL database server. This bug has earned a CVSS severity rating of 9.8 (10

Authentication 272

Authentication Engineering Malware Passwords 272

Krebs on Security

FEBRUARY 28, 2024

But clicking the meeting link provided by the scammers prompts the user to run a script that quietly installs malware on macOS systems. It didn’t dawn on Doug until days later that the missed meeting with Mr. Lee might have been a malware attack. MacOS computers include X-Protect , Apple’s built-in antivirus technology.

Malware 330

Malware Cryptocurrency Software Phishing 330

Krebs on Security

MAY 17, 2022

The consensus seems to be that the ZIP file currently harbors a malware threat known as Ramnit , a fairly common but dangerous trojan horse that spreads by appending itself to other files. He said Saicoo did not address his concern that the driver package on its website was bundled with malware. Image: Virustotal.com.

Malware 353

Malware Government Internet Internet 353

Krebs on Security

APRIL 18, 2023

For the past seven years, a malware-based proxy service known as “ Faceless ” has sold anonymity to countless cybercriminals. The proxy lookup page inside the malware-based anonymity service Faceless. as a media sharing device on a local network that was somehow exposed to the Internet. Image: spur.us.

Malware 300

Malware Passwords Accountability Advertising 300

Krebs on Security

NOVEMBER 16, 2022

A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode , an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic.

Malware 334

Malware Banking Phishing DDOS 334

Tech Republic Security

AUGUST 9, 2024

Read more about a China-aligned cyberespionage threat actor dubbed StormBamboo, also known as Evasive Panda, which compromised an Internet Service Provider and infected targets with malware.

Malware 182

Malware Internet Internet DNS 182

Krebs on Security

JANUARY 31, 2025

The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “ The Manipulaters ,” have been the subject of three stories published here since 2015.

Phishing 267

Phishing Cybercrime Advertising Malware 267

Krebs on Security

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies. SocksEscort[.]com

Malware 244

Malware VPN Internet Internet 244

Krebs on Security

NOVEMBER 1, 2024

According to the market share website statista.com , booking.com is by far the Internet’s busiest travel service, with nearly 550 million visits in September. In November 2023, the security firm SecureWorks detailed how scammers targeted booking.com hospitality partners with data-stealing malware.

Phishing 272

Phishing Accountability Artificial Intelligence Cybercrime 272

Krebs on Security

JUNE 1, 2023

This post is a deep dive on “ Megatraffer ,” a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015. More recently, it appears Megatraffer has been working with ransomware groups to help improve the stealth of their malware. WHO IS MEGATRAFFER?

Malware 309

Malware Cybercrime Software Accountability 309

SecureList

APRIL 23, 2025

We immediately took action by communicating meaningful information to the Korea Internet & Security Agency (KrCERT/CC) for rapid action upon detection, and we have now confirmed that the software exploited in this campaign has all been updated to patched versions.

Malware 144

Malware Software Encryption Internet 144

SecureList

MAY 15, 2025

The percentage of ICS computers on which denylisted internet resources were blocked continues to decrease. In Q1 2025, the percentage of ICS computers on which various types of malware spread via the internet and email were blocked increased for the first time since the beginning of 2023. times more) were blocked.

Spyware 94

Spyware Phishing Internet Internet 94

Krebs on Security

MARCH 11, 2022

As their cities suffered more intense bombardment by Russian military forces this week, Ukrainian Internet users came under renewed cyberattacks, with one Internet company providing service there saying they blocked ten times the normal number of phishing and malware attacks targeting Ukrainians.

DNS 333

DNS Internet Internet Phishing 333

Malwarebytes

JANUARY 22, 2025

The MotW is an attribute added to files by Windows when they have been sourced from an untrusted location, like the internet or a restricted zone. The MotW is what triggers warnings that opening or running such files could lead to potentially dangerous behavior, including installing malware on their devices.

Internet 143

Internet Internet Malware Risk 143

Security Affairs

DECEMBER 17, 2024

The FBI warned of a fresh wave of HiatusRAT malware attacks targeting internet-facing Chinese-branded web cameras and DVRs. The Federal Bureau of Investigation (FBI) released a Private Industry Notification (PIN) to warn of HiatusRAT malware campaigns targeting Chinese-branded web cameras and DVRs. ” reads the PIN report.

Architecture 110

Architecture Internet Internet Malware 110

Security Affairs

MAY 9, 2025

The FBI warns that attackers are using end-of-life routers to deploy malware and turn them into proxies sold on 5Socks and Anyproxy networks. Attackers target EoL devices to deploy malware by exploiting vulnerabilities and create botnets for attacks or proxy services. ” reads the alert.

Malware 106

Malware Cyber Attacks Hacking Passwords 106

Krebs on Security

OCTOBER 12, 2020

has executed a coordinated legal sneak attack in a bid to disrupt the malware-as-a-service botnet Trickbot , a global menace that has infected millions of computers and is used to spread ransomware. 27, UHS shut down its computer systems at healthcare facilities across the United States in a bid to stop the spread of the malware.

Healthcare 361

Healthcare Ransomware Internet Internet 361

Security Affairs

NOVEMBER 10, 2024

internet service providers in recent months as part of a cyber espionage campaign code-named Salt Typhoon. internet-service providers in recent months in pursuit of sensitive information, according to people familiar with the matter.” China-linked threat actors have breached several U.S. Wall Street Journal reported.

Hacking 133

Hacking Internet Internet Government 133

Krebs on Security

NOVEMBER 14, 2024

Shefel asserts he and his team were responsible for developing the card-stealing malware that Golubov’s hackers installed on Target and Home Depot payment terminals, and that at the time he was technical director of a long-running Russian cybercrime community called Lampeduza. “I’m also godfather of his second son.”

Retail 269

Retail Advertising Cryptocurrency Cybercrime 269

Krebs on Security

MARCH 27, 2025

Many successful phishing attacks result in a financial loss or malware infection. When Cloudflare responded by blocking the sites with a phishing warning, the real Internet address of these sites was exposed as belonging to a known “bulletproof hosting” network called Stark Industries Solutions Ltd.

Phishing 222

Phishing Government Engineering Internet 222

Schneier on Security

OCTOBER 17, 2023

Like any internet voting system, it has inherent security vulnerabilities: if there are malicious insiders, they can corrupt the vote count; and if thousands of voters’ computers are hacked by malware, the malware can change votes as they are transmitted. To demonstrate this, I built a proof-of-concept demonstration.

Malware 359

Malware Internet Internet Government 359

Security Affairs

APRIL 22, 2025

Japan s Financial Services Agency (FSA) reported that the damage caused by unauthorized access to and transactions on internet trading services is increasing. Keeping devices updated and using reliable antivirus software also helps prevent malware-related data theft. ” reads the FSA’s alert.

Financial Services 122

Financial Services Passwords Accountability Antivirus 122

Schneier on Security

SEPTEMBER 19, 2024

The FBI has shut down a botnet run by Chinese hackers: The botnet malware infected a number of different types of internet-connected devices around the world, including home routers, cameras, digital video recorders, and NAS drives.

Telecommunications 302

Telecommunications Media Malware Internet 302

Schneier on Security

APRIL 30, 2021

Apple just patched a MacOS vulnerability that bypassed malware checks. The operating system wouldn’t even give its most basic prompt: “This is an application downloaded from the Internet. Apple mistakenly assumed that applications will always have certain specific attributes. Are you sure you want to open it?”

Internet 342

Internet Internet Malware 342

Schneier on Security

NOVEMBER 16, 2020

But now I have this excellent paper from MIT researchers: “Going from Bad to Worse: From Internet Voting to Blockchain Voting” Sunoo Park, Michael Specter, Neha Narula, and Ronald L. It can make ballot secrecy difficult or impossible. I’ve also quoted this XKCD cartoon.

Computers and Electronics 360

Computers and Electronics Internet Internet Risk 360

Krebs on Security

NOVEMBER 28, 2022

But that story omitted an important historical detail about Pushwoosh: In 2013, one of its developers admitted to authoring the Pincer Trojan , malware designed to surreptitiously intercept and forward text messages from Android mobile devices. ” wherein Shmakov acknowledged writing the malware as a freelance project.

Mobile 288

Mobile Malware Technology Government 288

Krebs on Security

SEPTEMBER 27, 2023

The victim shaming site operated by the Snatch ransomware group is leaking data about its true online location and internal operations, as well as the Internet addresses of its visitors, KrebsOnSecurity has found. Probably the most active Internet address accessing Snatch’s darknet site is 193.108.114[.]41 top , sntech2ch[.]top

Ransomware 322

Ransomware Internet Internet Phishing 322

Krebs on Security

DECEMBER 4, 2024

Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies. “It’s possible this is a shakedown by Kaliningrad authorities of a local internet thug who has tens of millions of dollars in cryptocurrency,” Intel 471 wrote in an analysis published Dec.

Cybercrime 247

Cybercrime Ransomware Cryptocurrency Government 247

Krebs on Security

MARCH 11, 2025

This month’s bundle of patch love from Redmond also addresses six other vulnerabilities Microsoft has rated “critical,” meaning that malware or malcontents could exploit them to seize control over vulnerable PCs with no help from users.

System Administration 234

System Administration Engineering Internet Internet 234

Security Affairs

APRIL 25, 2025

Kaspersky notified Korea Internet & Security Agency (KrCERT/CC), the researchers discovered that threat actor exploited a one-day vulnerability in Innorix Agent for lateral movement. The attackers used multiple hacking tools and malware, including ThreatNeedle , Agamemnon downloader, wAgent , SIGNBT, and COPPERHEDGE.

Malware 95

Malware Software Encryption Hacking 95