Year: 2019

ExileRAT Campaign Has Tibetan Government in Its Sights

Delaware, USA ā€“ February 7, 2019 ā€“ A harmful PPSX document was delivered in terms of the recent malware campaign under the pretense on Central Tibetan Administration and targeting their subscribers’ mailing list, Talosā€™ security research team reports. The new ExileRAT campaign uses old features like information stealing and uploading and downloading the files but […]

Read More
SpeakUp Backdoor Used to Install Monero Miners on Linux Servers

Delaware, USA ā€“ February 6, 2019 ā€“ The new campaign targets Linux and MacOS systems primarily in Asia, Central and South America. Checkpoint’s researchers discovered that adversaries use SpeakUp backdoor to gain access to the systems and install the infamous XMRig for mining Monero cryptocurrency. For initial infection, they exploit CVE-2018-20062 vulnerability that allows them […]

Read More
CookieMiner Malware for Mac Steals Credentials and Credit Card Data

Delaware, USA ā€“ February 5, 2019 ā€“ A new threat for Mac users is designed to steal credentials and browser cookies, as well as cryptocurrency wallet data and keys. At the end of last year, several new malware strains for Mac were discovered, and adversaries used some pieces of code from them to create CookieMiner. […]

Read More
LockerGoga Freezes Operations of Altran Š”ompany

Delaware, USA ā€“ February 4, 2019 ā€“ Daily operations of the global leader in engineering and R&D services fell down being affected by LockerGoga ransomware that encrypted files spreading throughout the company network. In their press release, the company informed about stopping all the applications and IT network and starting investigation and recovery. Although the […]

Read More
Remexi Malware Used in Attacks on Diplomatic Entities

Delaware, USA ā€“ February 1, 2019 ā€“ Kaspersky Lab’s security researchers published a report on the campaign targeted at Iran-based foreign diplomatic entities by the Chafer APT group. The campaign was conducted in the fall of 2018; adversaries spread an improved version of the Remexi trojan, created in six months before the start of the […]

Read More
APT39 Conducts Cyberespionag Operations Targeted at the Middle East

Delaware, USA ā€“ January 31, 2019 ā€“ The newly discovered Iranian APT group collects personal information about its victims attacking telecommunications and traveling companies. The primary targets of APT39 attacks are located in the Middle East and the United States. FireEye researchers discovered the group’s operations at the end of 2018 and tracked its activities […]

Read More
AZORult Comes Back Under the Cloak of Google Update Installer

Delaware, USA ā€“ January 30, 2019 ā€“ The activity of the updated version of AZORult trojan was noticed in the wild again, the Minerva Labā€™s research team informs. The malware is masquerading to be an authentic Google Update installer and once it contaminates a victim machine it replaces a legitimate Google Updater. The replacing malicious […]

Read More
Malformed TeamViewer Used to Spread Spyware

Delaware, USA ā€“ January 29, 2019 ā€“ Trend Micro researchers uncovered a malicious campaign that spreads trojan spyware using a modified version of TeamViewer. A week and a half ago, a security researcher FewAtoms discovered a link to the malicious self-extracting SFX/SEA archive, which, under the guise of a program for remote access, installed a […]

Read More
Zero-Day in Total Donations Plugin Allows to Compromise WordPress Websites

Delaware, USA ā€“ January 28, 2019 ā€“ A critical vulnerability was found in one of the popular WordPress commercial plugins, Wordfence reports. According to the published information, the Total Donations plugin contains an Ajax code which makes the whole WordPress site unsecured and enables remote malicious manipulations like changing core settings or even modifying the […]

Read More
The Ursnif Trojan is Capturing Banking Credentials Again

Delaware, USA ā€“ January 25, 2019 ā€“ Cisco Talos dissected the newest version of Ursnif malware being distributed in the recent campaign and published discovered indicators of compromise in the report. Threat actors behind this version of popular trojan use a surefire way to deliver the payload by attaching an MS Word file containing a […]

Read More