Malware

Pierluigi Paganini December 13, 2017
A banking Trojan targeting the Polish banks was found in Google Play

It has happened again, several banking Trojan samples have been found on Google Play, this time the malicious code targeted a number of Polish banks. The malware was disguised as seemingly legitimate apps “Crypto Monitor”, a cryptocurrency price tracking app, and “StorySaver”, a third-party tool for downloading stories from Instagram. The malicious code is able to display […]

Pierluigi Paganini December 12, 2017
The OceanLotus MacOS Backdoor Transforms into HiddenLotus with a Slick UNICODE Trick

Experts at Malwarebytes warns of a new variant of the macOS OceanLotus backdoor is using an innovative technique to avoid detection, A few years ago the bad actors realized they could use UNICODE characters that looked like English characters to lead unsuspecting victims to malicious websites. Now, they have figured out how to use a […]

Pierluigi Paganini December 11, 2017
MoneyTaker group: Group-IB uncovered a cyber gang attacking banks in the USA and Russia

Group-IB spotted the operations of a Russian-speaking cyber gang tracked as MoneyTaker group that stole as much as $10 million from US and Russian banks. Researchers from security firm Group-IB has spotted the operations of a Russian-speaking cyber gang tracked as MoneyTaker that has stolen as much as $10 million from U.S. and Russian banks […]

Pierluigi Paganini December 11, 2017
Dark Web – The median price range for Android ransomware kits hits $200

According to the firm Carbon Black, Android ransomware kits are very popular in the dark web, and the median price range for them hits $200. According to the firm Carbon Black, Android ransomware kits are very popular in the dark web, more than 5,000 Android ransomware kit listings have been discovered in 2017. Even if most ransomware kits are still focused […]

Pierluigi Paganini December 09, 2017
Linux.ProxyM IoT Botnet now used to launch hacking attacks against websites

A new IoT botnet leveraging the Linux.ProxyM malware is currently being used by crooks in a campaign attempting to hack websites. Security experts at Doctor Web discovered a new IoT botnet leveraging the Linux.ProxyM malware that is currently being used in a campaign attempting to hack websites. Experts first analyzed the Linux.ProxyM in July, it was used to create a proxy […]

Pierluigi Paganini December 09, 2017
Crooks abused the Orcus RAT to target Bitcoin investors

According to Fortinet, crooks are abusing the Orcus RAT to target Bitcoin investors with their malicious software. Crooks always follow money trying to catch any opportunity, such as the recent spike in the value of Bitcoin. According to the experts from Fortinet, cybercriminals are abusing the Orcus RAT to target Bitcoin investors with their malicious […]

Pierluigi Paganini December 09, 2017
Android Janus vulnerability allows attackers to inject Malware into legitimate apps avoiding detection

Google fixed a bug dubbed Janus that could be exploited by attackers to inject malicious code into Android apps without affecting an app’s signature. Google fixed four dozen vulnerabilities this week, including a bug dubbed Janus that could be exploited by attackers to inject malicious code into Android apps without affecting an app’s signature verification certificates. Millions of Android […]

Pierluigi Paganini December 07, 2017
Thousands of WordPress sites infected with a Keylogger and cryptocurrency miner scripts

Nearly 5,500 WordPress websites are infected with a malicious script that logs keystrokes and in some loads a cryptocurrency miner in the visitors’ browsers. The experts from security firm Sucuri observed that that malicious script is being loaded from the “cloudflare.solutions” domain, that anyway is not linked with Cloudflare. According to PublicWWW, this malicious script […]

Pierluigi Paganini December 06, 2017
The StorageCrypt ransomware is the last malware in order of time exploiting SambaCry to target NAS Devices

StorageCrypt Ransomware is the last malware in order of time exploiting the SambaCry vulnerability, it was developed to target NAS Devices. Experts discovered a new strain of malware exploiting the SambaCry vulnerability (CVE-2017-7494), it has been called StorageCrypt Ransomware because it targets NAS Devices via SambaCry Exploit. The StorageCrypt ransomware demands between 0.4 and 2 Bitcoins ($5,000 […]

Pierluigi Paganini December 04, 2017
Global operation allowed law enforcement agencies to take down the Andromeda Botnet

A joint international operation conducted by the FBI, law enforcement agencies in Europe and private partners managed to dismantle the Andromeda botnet. A joint international operation conducted by the FBI and law enforcement agencies in Europe managed to dismantle the dreaded Andromeda botnet (aka Gamarue and Wauchos) last week. The Andromeda botnet has been around since 2011, it was […]