Year: 2017

Events correlation plays an important role in the incident detection and allows us to focus on the events that really matter to the business services or IT/security processes.

London, UK – July 25, 2017 – The Trickbot banking Trojan is used for Man-in-the-Browser attacks since mid-2016. Currently, adversaries use the Necurs botnet for its distribution. This botnet is tied to Locky and Jeff Ransomware attacks and is capable of sending millions of emails per day.

London, UK – July 20, 2017 – NukeBot’s author published its source code in the Darknet this spring. Since then various modifications of NukeBot banking Trojan began to appear on the Internet. Researchers from Kaspersky Lab have analyzed NukeBot modifications they found in recent months and shared the results.

London, UK – July 18, 2017 – Adversaries continue to improve OSX/Dok discovered at the end of April for banking credentials stealing. Researchers at Check Point report that a phishing campaign continues.

London, UK – July 13, 2017 – Researchers from Trend Micro reported an increased number of attacks using the cross-platform Remote Access Trojan Adwind. Their number has doubled over the past month.

London, UK – July 11, 2017 – The last two weeks the world’s attention has been drawn to NotPetya / GoldenEye APT attack. That’s why some other attacks attract less attention than they deserve. Researchers from the Securelist reported a new modification of Neutrino for POS terminals.

London, UK – July 6, 2017 – This group has been operating for several years and uses its malvertising network for infecting their victims with a variety of viruses. Despite the fact that their activities have long been known, AdGholas group is still active and evolving its methods.

London, UK – July 4, 2017 – Researchers from Trend Micro reported a new threat created to attack large enterprises. Sorebrect is a fileless Ransomware that injects malicious code into svchost.exe process. This virus gets delivered into a system through the malicious use of the PsExec utility, which allows system administrators to run files or […]

It’s been a hot summer for security industry: in less than a week since the initially suspected ransomware Petya.A has turned out to be much more than meets the eye. Security researchers around the world have rightfully dubbed it NotPetya and EternalPetya, as the malware was never meant to ask for ransom – it was […]

London, UK – June 27, 2017 – We created a SIEM use case that detects the new version of infamous Petya ransomware . Petya A / PetrWrap Ransomware detector for ArcSight, QRadar and Splunk is available free of charge for all organizations after registration in the S.M.A. Cloud. Currently, we are working on finding and […]