malware

Pierluigi Paganini August 30, 2017
Onliner Spambot – More than 711 Million email addresses open and accessible online

An archive containing more than 630 million email addresses used by the spambot server dubbed ‘Onliner Spambot’  has been published online. The Onliner Spambot dump is the biggest one of its kind, it was discovered by the security researcher who goes online with the handle Benkow. The database was hosted on an “open and accessible” server in Netherlands containing a […]

Pierluigi Paganini August 29, 2017
India and Pakistan hit by state-sponsored cyber espionage campaign

The security firm Symantec has discovered another cyber espionage campaign against India and Pakistan which is likely to be state-sponsored. Security experts at Symantec have uncovered a sustained cyber spying campaign against Indian and Pakistani entities involved in regional security issues. The nature of the targets and the threat actors’ techniques suggest it is a […]

Pierluigi Paganini August 27, 2017
Defray Ransomware used in targeted attacks on Education and Healthcare verticals

Researchers at Proofpoint spotted Defray Ransomware, a new ransomware used in a targeted campaign against education and healthcare organizations. Earlier this month, researchers at Proofpoint spotted a targeted ransomware campaign against education and healthcare organizations. The ransomware used in the campaign was dubbed Defray, based on the command and control (C&C) server hostname used for the […]

Pierluigi Paganini August 26, 2017
Watch out! Adware spreading via Facebook Messenger

Security experts from Kaspersky Lab have spotted an ongoing cross-platform malware campaign that leverages Facebook Messenger. Security experts from Kaspersky Lab have spotted an ongoing cross-platform malware campaign on Facebook Messenger, spammers are actually infecting users of all platform with adware. Users receive a video link that redirects them to a bogus website set up to lure them to […]

Pierluigi Paganini August 25, 2017
Mobile Trojan Development Kits allow creating ransomware without the need to write code

Researchers at Symantec have discovered Trojan Development Kits that allow creating Android ransomware without the need to write code. Ransomware continues to represent a serious threat to users and organizations. Unfortunately, it is easy for crooks arranging their own ransomware campaign by using numerous RaaS services offered online. Recently researchers at Symantec discovered a new […]

Pierluigi Paganini August 23, 2017
Neptune exploit kit used to deliver Monero cryptocurrency miners via malvertising

According to a new report published by FireEye, crooks have been using the Neptune exploit kit to deliver cryptocurrency miners via malvertising campaigns. According to experts at FireEye, crooks are exploiting the Neptune exploit kit (aka Terror EK, Eris, and Blaze) to delivery cryptocurrency miners via malvertising campaigns. The Neptune exploit kit was first spotted in January and was […]

Pierluigi Paganini August 22, 2017
Fileless cryptocurrency miner CoinMiner uses NSA EternalBlue exploit to spread

A new fileless miner dubbed CoinMiner appeared in the wild, it uses NSA EternalBlue exploit and WMI tool to spread. A new strain of Cryptocurrency Miner dubbed CoinMiner appeared in the wild and according to the experts it is hard to detect and infects Windows PCs via EternalBlue NSA exploit. CoinMiner is a fileless malware that leverages the WMI […]

Pierluigi Paganini August 21, 2017
SyncCrypt Ransomware hides its components in image files

A new strain of ransomware distributed through spam emails, dubbed SyncCrypt, hides its components inside harmless-looking images. A new strain of ransomware recently discovered, dubbed SyncCrypt, hides its components inside harmless-looking images. The SyncCrypt ransomware is distributed through spam emails that use attachments containing WSF files pretending to be court orders. Once the victims execute the attachment, an embedded JScript fetches seemingly innocuous images from specific locations and […]

Pierluigi Paganini August 18, 2017
Faketoken evolves and targets taxi booking apps to steal banking info

Kaspersky discovered a news strain of the mobile banking Trojan Faketoken that displays overlays on top of taxi booking apps to steal banking information. Security experts from Kaspersky have discovered a news strain of the infamous mobile banking trojan Faketoken that implements capabilities to detect and record an infected device’s calls and display overlays on top […]

Pierluigi Paganini August 17, 2017
NotPetya ransomware caused $300m losses to the shipping giant Maersk

The transportation giant Maersk announced that it would incur hundreds of millions in U.S. dollar losses due to the NotPetya ransomware massive attack. A.P. Moller-Maersk, the transportation and logistics firm, announced Tuesday that it would incur hundreds of millions in U.S. dollar losses due to the NotPetya ransomware massive attack. According to the second quarter earnings report, there were expecting losses between […]