Malware Manifesto

   27th July, 2018  By Danny Palmer ZDNet   Summary - A new form of cryptocurrency-mining malware is targeting corporate networks across the world, employing a combination of PowerShell and EternalBlue to stealthily spread.   Dubbed PowerGhost, the fileless malware can secretly embed itself on a single system on a network then spread to other PCs and servers across organisations. The cryptojacker has been uncovered by researchers at security company Kaspersky Lab, who detected it on corporate networks across the globe, with the largest concentration of infections in India, Brazil, Columbia, and Turkey. PowerGhost has also been detected across Europe and North America.  Article Link - Read more  Glossary Blog Back to the Malware Manifesto

   26th July, 2018  By Douglas Bonderud Security Intelligence   Summary - A previously unidentified threat group, RANCOR, is conducting malware-based espionage attacks in Singapore and Cambodia, according to a June 2018 report from Palo Alto Networks Unit 42. After observing the group throughout both 2017 and 2018, researchers identified two new malware strains: DDKONG and PLAINTEE.   Given the highly targeted distribution of this malware and the political nature of its decoy files, Palo Alto Networks concluded that RANCOR’s primary objective is likely espionage.  Article Link - Read more  Glossary Blog Back to the Malware Manifesto

   18th July, 2018  By Catalin Cimpanu Bleeping Computer   Summary - A new version of the Kronos banking trojan is making the rounds, according to Proofpoint security researchers, who say they've identified at last three campaigns spreading a revamped version of this old trojan that had its heyday back in 2014.   According to a report published yesterday evening, first samples of this new Kronos variant have been spotted in April, this year. While initial samples appeared to be tets, real-life campaigns got off the ground in late June, when researchers started detecting malspam and exploit kits delivering this new version to users in the wild.  Article Link - Read more  Glossary Blog Back to the Malware Manifesto

   18th July, 2018  By Catalin Cimpanu Bleeping Computer   Summary - The source code of a top-of-the-line Android banking trojan has been leaked online and has since rapidly spread in the malware community, worrying researchers that a new wave of malware campaigns may be in the works. This malware's name is Exobot, an Android banking trojan that was first spotted at the end of 2016, and which its authors mysteriously abandoned by putting its source code for sale in January this year. Article Link - Read more   Glossary Blog Back to the Malware Manifesto

   20th July, 2018 By Mikhail Kuzin Secure List   Summary - An interesting aspect of studying a particular piece of malware is tracing its evolution and observing how the creators gradually add new monetization or entrenchment techniques. Also of interest are developmental prototypes that have had limited distribution or not even occurred in the wild. We recently came across one such sample: a macOS backdoor that we named Calisto.   The malware was uploaded to VirusTotal way back in 2016, most likely the same year it was created. But for two whole years, until May 2018, Calisto remained off the radar of antivirus solutions, with the first detections on VT appearing only recently.  Article Link - Read more  Glossary Blog Back to the Malware Manifesto

   19th July, 2018  By James Quinn Alien Vault   Summary - Continuing the 2018 trend of cryptomining malware, I’ve found another family of mining malware similar to the “massminer” discovered in early May.  I’m calling this family ZombieBoy since it uses a tool called ZombieBoyTools to drop the first dll.   ZombieBoy, like MassMiner, is a cryptomining worm that uses some exploits to spread. However, unlike MassMiner, ZombieBoy uses WinEggDrop instead of MassScan to search for new hosts. ZombieBoy is being continually updated, and I’ve been obtaining new samples almost daily.  Article Link - Read more  Glossary Blog Back to the Malware Manifesto

   18th July, 2018  By Pierluigi Paganini Security Affiairs   Summary - Security experts from ESET uncovered an ongoing cyber espionage campaign aimed at Ukrainian government institutions and involving three different RATs, including the custom-made VERMIN. Security researchers from ESET uncovered an ongoing cyber espionage campaign aimed at Ukrainian government institutions, attackers used at least three different remote access Trojans (RATs).   The campaign was first spotted in January by experts from PaloAlto Networks when the researchers discovered a new piece of malware tracked VERMIN RAT targeting Ukraine organizations. Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  5th July, 2018 By Mohit Kumar The Hacker News   Summary - Security researchers have discovered an interesting piece of malware that infects systems with either a cryptocurrency miner or ransomware, depending upon their configurations to decide which of the two schemes could be more profitable.   While ransomware is a type of malware that locks your computer and prevents you from accessing the encrypted data until you pay a ransom to get the decryption key required to decrypt your files, cryptocurrency miners utilize infected system's CPU power to mine digital currencies.  Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  2nd July, 2018 By Lawrence Abrams Bleeping Computer   Summary - A distribution campaign for a new ransomware called Nozelesn is currently underway that is targeting Poland. This campaign started July 2nd and we already have reports from victims in our forums and numerous cases have been spotted on ID Ransomware.   MalwareHunterTeam noticed numerous submissions to ID Ransomware this morning from Poland and a new topic created by victims in the BleepingComputer forums. A researcher at CERT Polska, the Computer Emergency Response Team for Poland, has also stated that they believe the ransomware is being distributed through a spam campaign pretending to be a DHL invoice.  Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  30th June, 2018  By Pierluigi Paganini Security Affairs   Summary - The former NSA white hat hacker and malware researcher Patrick Wardle analyzed a new mac malware dubbed OSX.Dummy that targets the cryptocurrency community. The popular experts decided to analyze the malicious code after the security researcher Remco Verhoef (@remco_verhoef) posted an interesting entry to SANS ‘InfoSec Handlers Diary Blog’ titled “Crypto community target of MacOS malware.” “Previous days we’ve seen multiple MacOS malware attacks, originating within crypto related Slack or Discord chats groups by impersonating admins or key people. Small snippets are being shared, resulting in downloading and executing a malicious binary.” wrote Verhoef.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

    29th June, 2018 By Catalin Cimpanu Bleeping Computer   Summary - Security firm FireEye has detected that malware authors have deployed the PROPagate code injection technique for the first time inside a live malware distribution campaign.   PROPagate is a relatively new code injection technique discovered last November. Back then, a security researcher found that an attacker could abuse the SetWindowSubclass API, a function of the Windows operating system that manages GUIs, to load and execute malicious code inside the processes of legitimate apps.  Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  22nd June, 2018  By Pierluigi Paganini  Security Affairs   Summary - GZipDe is downloader that is used by threat actors to fetch other payloads from a server controlled by attackers. The malware was detected after user from Afghanistan has uploaded a weaponized Word document on VirusTotal service, the document refers to the Shanghai Cooperation Organization Summit.   At the time it is not possible to attribute the malicious code to a specific actor, VirusTotal doesn’t share information about the source of the upload and the target of the attack was not disclosed, the researchers were only able to analyze the sample.   Article Link - Read more Glossary Blog Back to the Malware Manifesto

  27th April, 2018 By Tara Seals Threat Post   Summary - Ransomware has lately lost its status as the queen of the cybercrime prom, but a new iteration of the nefarious SamSam extortion code shows that it can still make a bid to be sparkly and attention-getting.   The latest version of SamSam has taken the malware road less traveled, ditching widespread spam campaigns for unusually targeted, whole-company attacks. According to an analysis by Sophos, in a reversal of previous tactics, SamSam operators are now launching thousands of copies of the ransomware at once into individual organizations, each of which has been carefully selected.   Article Link - Read more Glossary Blog Back to the Malware Manifesto

  18th June, 2018 By Eduard Kovacs on Security Week Summary - A cyber-espionage group believed to be operating out of China has developed a new piece of malware that appears to be based on one of the first tools used by the threat actor.   The actor is known as APT15, Ke3chang, Mirage, Vixen Panda, Royal APT and Playful Dragon, and its tools are tracked by various cybersecurity companies as Mirage, BS2005, RoyalCLI, RoyalDNS, TidePool, BMW and MyWeb. The group has been known to target organizations in the defense, high tech, energy, government, aerospace, manufacturing and other sectors.   Article Link - Read more Glossary Blog Back to the Malware Manifesto

  18th June, 2018 By Catalin Cimpanu Bleeping Computer   Summary - When it was released back in 2015, one of the main perks of Windows 10 was the improved security features that made it harder for rootkits to get a foothold on Microsoft's new OS.   But three years later, security researchers from Romania-based antivirus vendor Bitdefender say they've discovered a new adware strain named Zacinlo that uses a rootkit component to gain persistence across OS reinstalls, a rootkit component that's even effective against Windows 10 installations.   In fact, researchers say that 90% of all Zacinlo's recent victims are Windows 10 users, showing that crooks intentionally designed their "product" to work against Microsoft's latest OS.   Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  19th June, 2018 By Pierluigi Paganini Security Affiars   Summary - Malware researchers from ESET have discovered a new strain of Android RAT, tracked as HeroRat, that leverages Telegram protocol for command and control, and data exfiltration.   HeroRat isn’t the first malware abusing Telegram protocol, past investigation reported similar threats like TeleRAT and IRRAT.   The new RAT has been in the wild at least since August 2017 and in March 2018 its source code was released for free on Telegram hacking channels allowing various threat actors to create their own variant.    Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  19th June, 2018 By Catalin Cimpanu Bleeping Computer   Summary - Olympic Destroyer, the malware that hit Pyeongchang 2018 Winter Olympics, is still alive and infecting new victims, according to a report published earlier today by Russian antivirus vendor Kaspersky Labs. The company's security researchers say they've detected Olympic Destroyer infections across Europe in May and June 2018. New victims include financial organizations in Russia, and biological and chemical threat prevention laboratories in Europe and Ukraine.   Article Link - Read more  Glossary Blog Back to the Malware Manifesto

  20th June, 2018 By Catalin Cimpanu Bleeping Computer   Summary - Security researchers have spotted a new commercial malware product that's been put up for sale on hacking forums for the lowly price of only $50, paid in Bitcoin.   Named Kardon Loader, this is a new malware strain, currently still under development, in a "beta" stage according to its author.    Article Link - Read more  Glossary Blog Back to the Malware Manifesto

  20th June, 2018 By Curtis Franklin Jr. Dark Reading   Summary - The malware pulls together a variety of techniques to gain a foothold and remain undiscovered.  Cybercriminals looking to maximize their investments are using evermore sophisticated software techniques and increasingly aggressive steps against their fellow malware authors. Those are among the conclusions by researchers at Deep Instinct about a new strain of malware found within the last two months.   The new malware, dubbed Mylobot, pulls together a variety of techniques to gain a foothold and remain undiscovered.   Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  15th June, 2018 By Doug Olenick SCMagazine   Summary - Some of the positive vibes taken away from President Trump's recent meeting with North Korea's Kim Jong Un may be tempered following a joint DHS-FBI report detailing a new trojan dubbed Typeframe being used by the Hermit Kingdom.   The Malware Analysis Report (MAR) stated Typeframe is being used by the known North Korean hacking group Hidden Cobra and federal officials are distributing the report to help reduce exposure to the malware. DHS and the FBI used 11 samples of the malware containing 32-bit and 64-bit Windows executable files and a malicious Microsoft Word document that contains Visual Basic for Applications macros. Article Link - Read more Glossary Blog Back to the Malware Manifesto

    15th June, 2018 By Catalin Cimpanu Bleeping Computer   Summary -A malware campaign spreading a clipboard hijacker has infected over 300,000 computers, according to Chinese security firm Qihoo 360 Total Security.   The campaign has been raging for the past week and has spread a malware which Qihoo researchers have named Clipboard Wallet Hijacker.  Article Link - Read more     Glossary Blog Back to the Malware Manifesto

   14th June, 2018 By Catalin Cimpanu Bleeping Computer   Summary - The authors of the Satan ransomware have rebranded their "product" and they now go by the name of DBGer ransomware, according to security researcher MalwareHunter, who spotted this new version earlier today.   The change was not only in name but also in the ransomware's modus operandi. According to the researcher, whose discovery was later confirmed by an Intezer source code analysis, the new (Satan) DBGer ransomware now also incorporates Mimikatz, an open-source password-dumping utility.  Article Link - Read more   Glossary Blog Back to the Malware Manifesto

   14th June, 2018 By Catalin Cimpanu Bleeping Computer   Summary - Cybercriminals are currently developing a new strain of malware targeting Android devices which blends the features of a banking trojan, keylogger, and mobile ransomware.   Named MysteryBot, this malware strain is still under development, according to security researchers from ThreatFabric, who recently ran across this new threat.  Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  May 18th, 2018 By Justin Pot How-To Geek   Summary - It is unknown what exactly mshelper is doing to utilize the processor at such a high rate, but speculation on the Apple support forum suggests it could be some form of adware, or possibly a program used for mining cryptocurrency on a victim’s computer. Aside from using the processor, there also doesn’t seem to be any other issues it causes on affected desktops. Whatever the application is up to, you don’t want it. Remove it as soon as you notice it. Article Link - Read more   Glossary Blog Back to the Malware Manifesto

  May 28th, 2018 By Anonymous SPAMfigher News   Summary - A new crypto-mining malicious program WinstarNssmMiner is very nasty. Like all crypto-mining malicious programs, it attacks PCs followed with utilizing their GPU as well as CPU power for mining digital currencies. But, while any other crypto-mining malware can be easily eliminated using anti-malware else anti-virus software, WinstarNssmMiner works differently by crashing the system that tries removing it. Article Link - Read more     Glossary Blog Back to the Malware Manifesto