Malware

Pierluigi Paganini November 25, 2020
Group-IB Hi-Tech Crime Trends 2020/2021 report

Group-IB, a global threat hunting and intelligence company, has presented its annual Hi-Tech Crime Trends 2020/2021 report. In the report, the company examines key shifts in the cybercrime world internationally between H2 2019 and H1 2020 and gives forecasts for the coming year. The most severe financial damage has occurred as a result of ransomware activity. […]

Pierluigi Paganini November 24, 2020
Baidu Android apps removed from Play Store because caught collecting user details

Two Baidu Android apps have been removed from the Google Play Store in October after they’ve been caught collecting sensitive user details. Two apps belonging to Chinese tech giant Baidu, Baidu Maps and Baidu Search Box, have been removed from the Google Play Store at the end of October after they’ve been caught collecting sensitive […]

Pierluigi Paganini November 24, 2020
A new Stantinko Bot masqueraded as httpd targeting Linux servers

Researchers spotted a new variant of an adware and coin-miner botnet operated by Stantinko threat actors that now targets Linux servers. Researchers from Intezer have spotted a new variant of an adware and coin-miner botnet that is operated by Stantinko threat actors since 2012. The Stantinko botnet was first spotted by ESET in 2017, at the […]

Pierluigi Paganini November 24, 2020
TrickBot operators continue to update their malware to increase resilience to takedown

Following the recent takedown, the TrickBot operators have implemented various improvements to make it more resilient. In October, Microsoft’s Defender team, FS-ISAC, ESET, Lumen’s Black Lotus Labs, NTT, and Broadcom’s cyber-security division Symantec joined the forces and announced a coordinated effort to take down the command and control infrastructure of the infamous TrickBot botnet. Even if Microsoft and its partners have brought down the TrickBot […]

Pierluigi Paganini November 23, 2020
FBI issued an alert on Ragnar Locker ransomware activity

The U.S. FBI is warning private industry partners of a surge in Ragnar Locker ransomware activity following a confirmed attack from April 2020. The U.S. Federal Bureau of Investigation (FBI) issued a flash alert (MU-000140-MW) to warn private industry partners of an increase of the Ragnar Locker ransomware activity following a confirmed attack from April […]

Pierluigi Paganini November 23, 2020
Massive threat campaign strikes open-source repos, Sonatype spots new CursedGrabber malware

Sonatype’s deep dive research allowed to identify a new family of Discord malware called CursedGrabber. Sonatype has discovered more malware in the npm registry which, following our analysis and multiple cyber threat intelligence reports, has led to the discovery of a novel and large scale malware campaign leveraging the open-source ecosystem. The malware called “xpc.js” […]

Pierluigi Paganini November 22, 2020
A cyberattack crippled the IT infrastructure of the City of Saint John

Officials confirm that the city of Saint John was hit by a massive cyberattack that has crippled the entire IT municipal infrastructure. The city of Saint John, Canada, was hit by a massive cyberattack that has crippled the entire IT municipal infrastructure, the incident was publicly disclosed on November 15. The cyberattack caused the shut […]

Pierluigi Paganini November 20, 2020
QakBot Big Game Hunting continues: the operators drop ProLock ransomware for Egregor

The QakBot banking trojan has dropped the ProLock ransomware, they are now opting for the Egregor ransomware in their operations. Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has discovered that QakBot (aka Qbot) operators have abandoned ProLock for Egregor ransomware. Egregor has been actively distributed since September 2020 and has so far hit […]

Pierluigi Paganini November 19, 2020
We infiltrated an IRC botnet. Here’s what we found

The CyberNews.com Investigation team carried out an infiltration operation against an IRC botnet and reported it to CERT Vietnam to help take it down. Original post @ https://cybernews.com/security/we-infiltrated-an-irc-botnet-heres-what-we-found/ In order to gather valuable information about the IRC botnet’s activity, we joined its Command and Control channel where we met the botmaster who was responsible for […]

Pierluigi Paganini November 19, 2020
New Grelos skimmer variant reveals murkiness in tracking Magecart operations

Security experts from RiskIQ discovered a new variant of the Grelos skimmer that presents overlap with Magecart group operations. Researchers from RiskIQ analyzed the increased overlap of a new variant of the skimmer dubbed Grelos and the operations of the groups under the Magecart umbrella. The analysis demonstrates the difficulty in associating new strains of skimmer to groups […]