Malware

Pierluigi Paganini September 06, 2018
New OilRig APT campaign leverages a new variant of the OopsIE Trojan

The Iran-linked APT group OilRig was recently observed using a new variant of the OopsIE Trojan that implements news evasion capabilities. Experts at Palo Alto Networks observed a new campaign carried out by the Iran-linked APT group OilRig that was leveraging on a new variant of the OopsIE Trojan. The OilRig hacker group is an Iran-linked APT that has been […]

Pierluigi Paganini September 03, 2018
TrendMicro links Urpage hacking crew to other threat actors

Last week, security researchers from Trend Micro discovered a new threat actor, tracked as Urpage, that shares similarities with other three hacking crews. Researchers from Trend Micro linked a recently discovered actor, tracked as Urpage, to the hacking groups known as Bahamut, Confucius, and Patchwork. Trend Micro first connected the Confucius group to the Patchwork […]

Pierluigi Paganini September 02, 2018
Security Affairs newsletter Round 178 – News of the week

A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. Let me inform you that my new book, “Digging in the Deep Web” is online with a special deal 20% discount Kindle Edition Paper Copy Once again thank you! ·      Personal details of 37,000 Eir customers exposed […]

Pierluigi Paganini September 02, 2018
MagentoCore skimmer already infected 7,339 Magento stores

MagentoCore skimmer already infected 7,339 Magento stores, according to the Willem de Groot who uncovered the campaign, it is the most aggressive to date. The cybersecurity researcher Willem de Groot has uncovered a massive hacking campaign aimed at Magento stores. The hackers have already infected 7,339 Magento stores with a skimmer script, dubbed MagentoCore, that siphons payment card […]

Pierluigi Paganini September 02, 2018
Kaspersky warns of a new Loki Bot campaign target corporate mailboxes

Security experts from Kaspersky Lab have uncovered a new spam campaign leveraging the Loki Bot malware to target corporate mailboxes. The Loki Bot attacks started in July and aimed at stealing passwords from browsers, messaging applications, mail and FTP clients, and cryptocurrency wallets Loki Bot operators employ various social engineering technique to trick victims into opening weaponized attachments that […]

Pierluigi Paganini September 01, 2018
Cobalt cybercrime gang targets Russian and Romanian banks

On August 13, ASERT observed the Cobalt crime gang actively pushing a new campaign aimed at institutions in eastern Europe and Russia. Security experts from Netscout’s ASERT uncovered a new campaign carried out by the Cobalt cybercrime group. The attacks were detected on August 13, 2018, experts revealed that the hackers targeted also the NS Bank in Russia and Carpatica/Patria in […]

Pierluigi Paganini August 31, 2018
Federal prosecutors indicted a 20-year-old man who built the Satori botnet

A youngster (20) from Washington was indicted last week on federal computer hacking charges after rival hackers fingered him as the creator of a Mirai variant dubbed Satori. MalwareMustDie Team: “It’s time for every teenager or young man to know that playing with malware is the fastest way to finish in the jail” Mirai, Mirai […]

Pierluigi Paganini August 31, 2018
BusyGasper spyware remained undetected for two years while spying Russians

Security experts from Kaspersky Lab have uncovered a new strain of Android malware dubbed BusyGasper that remained hidden for two years. The BusyGasper Android spyware has been active since May 2016, it implements unusual features for this type of malware. Experts explained it is a unique spy implant with stand-out features such as device sensors listeners. […]

Pierluigi Paganini August 25, 2018
AdvisorsBot, a previously undocumented downloader involved in malicious email campaigns

Security researchers at Proofpoint security have discovered a previously undocumented downloader tracked as AdvisorsBot that was involved in malicious email campaigns. AdvisorsBot was uncovered in malicious email campaigns, attributed to the TA555 threat actor, targeting hotels, restaurants, and telecommunications entities. The name “AdvisorsBot” comes from the early command and control (C&C) domains that all contained the word […]

Pierluigi Paganini August 24, 2018
A new Cross-Platform Mirai Variant appeared in the wild

A new cross-platform Mirai variant appeared in the threat landscape, this one has been created using an open-source project. Security experts from Symantec have spotted a new cross-platform Mirai variant that has been created with an open-source project. Mirai malware first appeared in the wild in 2016 when the expert MalwareMustDie discovered it in massive […]