Malware

Pierluigi Paganini January 11, 2019
Victims of Pylocky ransomware can decrypt their files for free

Victims of the PyLocky Ransomware can use a tool released by security researcher Mike Bautista at Cisco Talos group to decrypt their files for free. I have good and bad news for the victims of the PyLocky Ransomware. The good news is that security researcher Mike Bautista at Cisco Talos group released a decryption tool […]

Pierluigi Paganini January 11, 2019
The ‘AVE_MARIA’ Malware

Ave Maria Malware – Phishing attempts spreading in the last days of the past year against an Italian organization operating in the Oil&Gas sector The  Cybaze-Yoroi ZLab researchers analyzed phishing attempts spreading in the last days of the past year against an Italian organization operating in the Oil&Gas sector. The malicious emails try to impersonate […]

Pierluigi Paganini January 07, 2019
ReiKey app for macOS can detect Mac Keyloggers using event taps

ReiKey is a free tool that allows to scan and detect keylogger that install persistent keyboard “event taps” to intercept your keystrokes. Good news for macOS users, a new open source tool dubbed ReiKey allows them to detect Mac Keyloggers. The ReiKey app monitor systems for applications that analyzed keyboard ‘event taps‘ to monitor and […]

Pierluigi Paganini January 05, 2019
Did Aurora Ransomware infect you? You can decrypt file for free

Victims of the Aurora Ransomware could use a decryptor tool developed by the popular malware researcher Michael Gillespie to decrypt their data for free. Good news for the victims of the Aurora Ransomware, there are many variants of this Windows malware but most of the victims have been infected by the version that appends the […]

Pierluigi Paganini January 04, 2019
New NRSMiner cryptominer NSA-Linked EternalBlue Exploit

A new variant of the NRSMiner is infecting users in the southern region of Asia, most of the victims are in Vietnam (54%), Iran (16%) and Malaysia (12%). The new version leverages the EternalBlue exploit to spread, experts observed that the threat also updates existing NRSMiner installs. ETERNALBLUE is an NSA exploit that made the headlines […]

Pierluigi Paganini January 02, 2019
Cloud Hosting Provider DataResolution.net hit by the Ryuk ransomware

The Cloud hosting provider Dataresolution.net was hit by a ransomware-based attack on Christmas Eve that took down its systems. Data Resolution LLC provides software hosting, business continuity systems, cloud computing, and data center services to more serves than 30,000 businesses worldwide, The news was first reported by the popular investigator Brian Krebs on KrebsOnSecurity, the company believe […]

Pierluigi Paganini January 02, 2019
Experts analyzed the distribution technique used in a recent Emotet campaign

ESET analyzed the distribution technique used by cyber criminals in new Emotet campaign that has recently affected various countries in Latin America. In November, experts from ESET uncovered a massive spam campaign that was distributing the Emotet malware. The campaign targeted several users in some Latin American countries and ESET shared details on the propagation used […]

Pierluigi Paganini December 31, 2018
‘Roma225’ campaign targets companies in the Italian automotive sector

‘Roma225’ campaign -The Cybaze-Yoroi ZLab researchers investigated a recent espionage malware implant weaponized to target companies in the Italian automotive sector. The malware was spread through well-written phishing email trying to impersonate a senior partner of one of the major Brazilian business law firms: “Veirano Advogados”. The malicious email intercepted during the CSDC operations contains […]

Pierluigi Paganini December 27, 2018
A new Shamoon 3 sample uploaded to VirusTotal from France

A new sample of Shamoon 3 was uploaded on December 23 to the VirusTotal platform from France, it is signed with a Baidu certificate. A new sample of the dreaded Shamoon wiper was uploaded on December 23 to the VirusTotal platform from France. This sample attempt to disguise itself as a system optimization tool developed […]

Pierluigi Paganini December 27, 2018
Hackers infect Linux servers with JungleSec Ransomware via IPMI Remote console

Since November, a new ransomware called JungleSec has been infecting servers through unsecured IPMI (Intelligent Platform Management Interface) cards. Security experts at BleepingComputer wrote about a new ransomware called JungleSec that is infecting victims through unsecured IPMI (Intelligent Platform Management Interface) cards. The ransomware was first observed early November. The IPMI is a set of computer interface […]