Malware

Pierluigi Paganini September 16, 2019
MobiHok RAT, a new Android malware based on old SpyNote RAT

A new Android malware has appeared in the threat landscape, tracked as MobiHok RAT, it borrows the code from the old SpyNote RAT. Experts from threat intelligence firm SenseCy spotted a new piece of Android RAT, dubbed MobiHok RAT, that used code from the old SpyNote RAT. At the beginning of July 2019, the experts […]

Pierluigi Paganini September 16, 2019
Astaroth Trojan leverages Facebook and YouTube to avoid detection

Cofense experts uncovered a new variant of the Astaroth Trojan that uses Facebook and YouTube in the infection process. Researchers at Cofense have uncovered a phishing campaign targeting Brazilian citizens with the Astaroth Trojan that uses Facebook and YouTube in the infection process. The attach chain appears to be very complex and starts with phishing […]

Pierluigi Paganini September 15, 2019
Security Affairs newsletter Round 231

A new round of the weekly newsletter arrived! The best news of the week with Security Affairs Hi folk, let me inform you that I suspended the newsletter service, anyway I’ll continue to provide you a list of published posts every week through the blog. Once again thank you! Experts found Joker Spyware in 24 […]

Pierluigi Paganini September 14, 2019
InnfiRAT Trojan steals funds from Bitcoin and Litecoin wallets

Researchers at Zscaler have spotted a new malware dubbed InnfiRAT that infects victims’ systems to steal cryptocurrency wallet data.  Researchers at Zscaler have discovered a new Trojan dubbed InnfiRAT that implements many standard Trojan capabilities along with the ability to steal cryptocurrency wallet data.  “As with just about every piece of malware, InnfiRAT is designed […]

Pierluigi Paganini September 13, 2019
WatchBog cryptomining botnet now uses Pastebin for C2

A new cryptocurrency-mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control (C&C) operations. Cisco Talos researchers discovered a new cryptocurrency-mining botnet tracked as WatchBog is heavily using the Pastebin service for command and control. The WatchBog bot is a Linux-based malware that is active since last year, it targets […]

Pierluigi Paganini September 12, 2019
LokiBot info stealer involved in a targeted attack on a US Company

Security researchers at Fortinet uncovered a malspam campaign aimed distributing the LokiBot malware at a US manufacturing company. FortiGuard SE Team experts uncovered a malspam campaign aimed distributing the LokiBot malware at a US manufacturing company. The Lokibot malware has been active since 2015, it is an infostealer that was involved in many malspam campaigns aimed […]

Pierluigi Paganini September 11, 2019
The Wolcott school district suffered a second ransomware attack in 4 months

Another ransomware attack hits a school district, the victim is an institute in Connecticut that was targeted twice in only four months. For the second time in just four months, another the Wolcott school district in Connecticut was a victim of a ransomware attack. Techers and students were not able to access the district’s internal […]

Pierluigi Paganini September 11, 2019
Dissecting the 10k Lines of the new TrickBot Dropper

Malware researchers at Yoroi-Cybaze analyzed the TrickBot dropper, a threat that has infected victims since 2016. Introduction TrickBot it is one of the best known Banking Trojan which has been infecting victims since 2016, it is considered a cyber-crime tool. But nowadays defining it a “Banking Trojan” is quite reductive: during the last years its modularity brought […]

Pierluigi Paganini September 09, 2019
Stealth Falcon’s undocumented backdoor uses Windows BITS to exfiltrate data

ESET researchers discovered a new malware associated with the Stealth Falcon APT group that abuses the Windows BITS service to stealthy exfiltrate data. Security researchers discovered a new malware associated with the Stealth Falcon cyber espionage group that abuses the Windows BITS service to stealthy data. Stealth Falcon is a nation-state actor active since at […]

Pierluigi Paganini September 09, 2019
Symantec uncovered the link between China-Linked Thrip and Billbug groups

The China-linked APT group Thrip is continuing to target entities in Southeast Asia even after its activity was uncovered by Symantec. Experts at Symantec first exposed the activity of the Chinese-linked APT Thrip in 2018, now the security firm confirms that cyber espionage group has continued to carry out attacks in South East Asia. In June […]