malware

Pierluigi Paganini October 09, 2017
Sri Lanka police arrest two men over cyber theft at the Taiwan Bank

The Sri Lanka authorities have arrested two men allegedly involved in cyber heist at an unnamed Taiwan bank that occurred last week. The Sri Lanka police have arrested two men allegedly involved in the Taiwan cyberheist, the suspects are accused to have hacked into computers at a Taiwan bank and stole millions of dollars last week. According to an official, the […]

Pierluigi Paganini October 05, 2017
CSE CybSec ZLAB Malware Analysis Report: APT28 Hospitality malware

The CSE CybSec Z-Lab Malware Lab analyzed the Hospitality malware used by the Russian APT28 group to target hotels in several European countries. The Russian hacker group APT28, also known as Sofacy or Fancy Bear, is believed to be behind a series of attacks in last July against travelers staying in hotels in Europe and Middle […]

Pierluigi Paganini October 04, 2017
Intezer researchers link CCleaner hack to Chinese APT17 hackers

Researchers from security firm Intezer speculate that the attack was powered by nation-state actor, likely the Chinese APT17 group. Security experts continue to investigate the recent attack against the supply chain of the popular software CCleaner. The hackers first compromised in July a CCleaner server, then exploited it to deliver a backdoored version of the 32-bit CCleaner […]

Pierluigi Paganini October 01, 2017
60% of institutions in Saudi Arabia hit by malware-based attacks

According to Kaspersky Lab, sixty percent of institutions in Saudi Arabia have experienced malware-based attacks over the past 12 months. Malware continues to be one of the most dangerous threats for organizations worldwide, and data recently disclosed by security firms. According to Kaspersky Lab, Saudi Arabia is under a constant malware-based attack, the experts reported that […]

Pierluigi Paganini October 01, 2017
Vxers abused legitimate VMware binary to spread Banking Trojan Distribution

Cisco researchers discovered a malware campaign abusing a legitimate VMware binary to spread a banking Trojan. The threat actor behind the campaign uses multiple methods of re-direction when infecting the victims’ machines in order to remain under the radar, it also implemented a variety of anti-analysis techniques. The malware is written in Delphi, a novelty for […]

Pierluigi Paganini September 28, 2017
‘Illusion Gap’ attack method bypasses Windows Defender and executes malware

Researchers have developed an attack method dubbed Illusion Gap for bypassing Windows Defender that will allow avoiding antivirus detection. Researchers from security firm CyberArk have devised a new technique dubbed ‘Illusion Gap’ that allows attackers to bypass Windows Defender. The technique leverages on the fact that Windows Defender detection can be bypassed by tricking the antivirus into […]

Pierluigi Paganini September 27, 2017
Experts analyzed an Advanced ‘all in memory’ CryptoWorm

The popular security expert Marco Ramilli shared the analysis of a cryptoworm having significant capabilities, enjoy the report! Introduction. Today I want to share a nice Malware analysis having an interesting flow. The “interesting” adjective comes from the abilities the given sample owns. Capabilities of exploiting, hard obfuscations and usage of advanced techniques to steal […]

Pierluigi Paganini September 27, 2017
ZNIU, the first Android malware family to exploit the Dirty COW vulnerability

Security experts at Trend Micro have recently spotted a new strain of Android malware, dubbed ZNIU, that exploits the Dirty COW Linux kernel vulnerability. The Dirty COW vulnerability was discovered by the security expert Phil Oester in October 2016, it could be exploited by a local attacker to escalate privileges. The name ‘Dirty COW’ is due to the fact that it’s […]

Pierluigi Paganini September 26, 2017
Europol report – Cyber attacks against ATM networks on the rise

Cyber criminals are targeting ATM machines through the banks’ networks, the operations involve squads of money mules for the cashout. The Europe’s policing agency warns of a rise of cyber attacks against ATM machines. Criminal organizations are targeting ATM machines through the banks’ networks, the operations involve squads of money mules for the cashout. “The malware being used has […]

Pierluigi Paganini September 25, 2017
RedBoot ransomware also modifies partition table, is it a wiper?

The RedBoot ransomware encrypts files on the infected computer, replaces the Master Boot Record and then modifies the partition table. Malware Blocker researcher discovered a new bootlocker ransomware, dubbed RedBoot, that encrypts files on the infected computer, replaces the Master Boot Record (MBR) of the system drive and then modifies the partition table. The experts noticed that […]