Malware

Pierluigi Paganini July 24, 2017
SLocker decompiled code leaked online for free, a gift for crooks and hackers

The SLocker code leaked online, it is one of the oldest mobile lock screen and file-encrypting ransomware. The code of the SLocker Android malware, one of the most popular Android ransomware families, has been leaked online for free, allowing crooks to develop their own variant of the threat. SLocker was first spotted in 2015, it is the […]

Pierluigi Paganini July 22, 2017
A Russian man involved in the development and maintenance of Citadel was sentenced to five years in prison

The Russian hacker Mark Vartanyan was sentenced to five years in prison for his involvement in the development and maintenance of the Citadel botnets. It’s a terrific moment for cyber criminals, law enforcement worldwide continues their fight against illegal activities online and the recent shut down of AlphaBay and Hansa black markets demonstrate it. The news of […]

Pierluigi Paganini July 22, 2017
Stantinko botnet was undetected for at least 5 years while infecting half a million systems

A huge botnet dubbed Stantinko was undetected for at least 5 years, the disconcerting discovery was made by researchers from security firm ESET. According to ESET, the Stantinko botnet has infected around half a million computers worldwide. Operators behind the botnet powered a massive adware campaign active since 2012, crooks mainly targeted users in Russia and Ukraine […]

Pierluigi Paganini July 21, 2017
Microsoft sued Fancy Bear to gain control of the domains used in the cyber espionage campaigns

Microsoft used the lawsuit to disrupt a large number of cyber espionage campaigns conducted by infamous Fancy Bear APT hacking group We have discussed several times about hacking back and the case we are going to analyze is a good example of an alternative approach to hit back an APT group. Microsoft used the lawsuit […]

Pierluigi Paganini July 21, 2017
Modified versions of Nukebot Trojan spotted in wild after code leak

Apparently, different cyber gangs are using modified versions of the Nukebot in wild after code Leak occurred in March 2017. Crooks are adapting the leaked source code for the Nukebot banking Trojan to target banks in the United States and France and to steal mail client and browser passwords. Apparently, different cyber gangs are using modified versions of […]

Pierluigi Paganini July 19, 2017
Wikileaks: CIA tasked Raytheon for analyzing TTPs used by threat actors in the wild

Wikileaks revealed that CIA contractor Raytheon Blackbird Technologies was tasked to analyze advanced malware and TTPs used by threat actors in the wild. Wikileaks continues to publish documents from Vault 7 leaks, today the organization has shed light on the collaboration between the US Intelligence agency and tech firms for malware development. The last batch […]

Pierluigi Paganini July 19, 2017
IntelliAV: Toward the Feasibility of Building Intelligent Anti-Malware on Android Devices

IntelliAV is a practical intelligent anti-malware solution for Android devices based on the open-source and multi-platform TensorFlow library. Android is targeted the most by malware coders as the number of Android users is increasing. Although there are many Android anti-malware solutions available in the market, almost all of them are based on malware signatures, and more advanced solutions based on […]

Pierluigi Paganini July 19, 2017
SHELLBIND IoT malware targets NAS devices exploiting SambaCry flaw

The seven-year-old remote code execution vulnerability SambaCry was exploited by the SHELLBIND IoT malware to target NAS devices. A new strain of malware dubbed SHELLBIND exploits the recently patched CVE-2017-7494 Samba vulnerability in attacks against Internet of Things devices. SHELLBIND has infected most network-attached storage (NAS) appliances, it exploits the Samba vulnerability (also known as SambaCry and EternalRed) […]

Pierluigi Paganini July 18, 2017
Two CryptoMix Ransomware variants emerged in a few days

Two CryptoMix Ransomware variants emerged in a few days, a circumstance that suggests the operators behind the threat are very active. Malwarebytes’ researcher Marcelo Rivero has spotted a new variant of the CryptoMix ransomware. #CryptoMix #Ransomware adds ext ".EXTE" to encrypted files, and the note "_HELP_INSTRUCTION.TXT" – md5: 1059676fbb9d811e88af96716cc1ffb5 pic.twitter.com/Ha4jeRMPEv — Marcelo Rivero (@MarceloRivero) July 13, […]

Pierluigi Paganini July 18, 2017
Android Backdoor GhostCtrl can spy on victims and take over Windows Systems

The GhostCtrl backdoor, is an OmniRAT-Based Android malware that can spy on victims, steal data and take over Windows System using the RETADUP infostealer. Today’s smartphones are as powerful as the computers of only a few years ago. Unfortunately, that also means that Android phones have as many instances of malware as desktop and laptop […]