dcsimg
February 24, 2021

LazyScripter: From Empire to double RAT

Malwarebytes’ Threat Intelligence analysts are continually researching and monitoring active malware campaigns and actor groups as the prevalence and sophistication of targeted attacks rapidly evolves. In this paper, we introduce a new APT group we have named LazyScripter, presenting in-depth analysis of the tactics, techniques, procedures, and infrastructure employed by this actor … [Read more...]

Filed Under: Malwarebytes news
February 12, 2021

Malvertising campaign on PornHub and other top adult brands exposes users to tech support scams

Threat actors involved in tech support scams have been running a browser locker campaign from November 2020 until February 2021 on the world’s largest adult platforms including PornHub. The same group behind this campaign has been active for much longer and we believe is tied to previous schemes we’ve identified before, making it one of the most prolific tech support scam operations … [Read more...]

Filed Under: adult, cybercrime, malvertising, pornhub, Social engineering, tech support scam
January 29, 2021

Cleaning up after Emotet: the law enforcement file

Emotet has been the most wanted malware for several years. The large botnet is responsible for sending millions of spam emails laced with malicious attachments. The once banking Trojan turned into loader was responsible for costly compromises due to its relationship with ransomware gangs. On January 27, Europol announced a global operation to take down the botnet behind what it called the most … [Read more...]

Filed Under: botnet, emotet, law enforcement, Malware, takedown, Threat analysis, uninstaller
January 6, 2021

Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat

This post was authored by Hossein Jazi On December 7 2020 we identified a malicious document uploaded to Virus Total which was purporting to be a meeting request likely used to target the government of South Korea. The meeting date mentioned in the document was 23 Jan 2020, which aligns with the document compilation time of 27 Jan 2020, indicating that this attack took place almost a year … [Read more...]

Filed Under: APT37, Hangul, korea, Office, rokrat, Social engineering, Threat analysis, VBA
December 22, 2020

Emotet returns just in time for Christmas

Emotet is a threat we have been tracking very closely throughout the year thanks to its large email distribution campaigns. Once again, and for about two months the botnet stopped its malspam activity only to return days before Christmas. In typical Emotet fashion, the threat actors continue to alternate between different phishing lures whose goal is to social engineer users into enabling … [Read more...]

Filed Under: Christmas, come back, cybercrime, emotet, Malware, ransomware, return, ryuk, trickbot
December 14, 2020

SolarWinds advanced cyberattack: What happened and what to do now

Over the weekend we learned more about the sophisticated attack that compromised security firm FireEye, the US Treasury and Commerce departments and likely many more victims. Threat actors hacked into IT company SolarWinds in order to use its software channel to push out malicious updates onto 18,000 of its Orion platform customers. This scenario, referred to as a supply-chain attack, is … [Read more...]

Filed Under: backdoor, FireEye, Hacking, solarwinds, sunburst, supply chain, Threat analysis
November 30, 2020

German users targeted with Gootkit banker or REvil ransomware

This blog post was authored by Hasherezade and Jérôme Segura On November 23, we received an alert from a partner about a resurgence of Gootkit infections in Germany. Gootkit is a very capable banking Trojan that has been around since 2014 and possesses a number of functionalities such as keystroke or video recording designed to steal financially-related information. In this latest campaign, … [Read more...]

Filed Under: banker, fileless, german, germany, gootkit, loader, Malware, ransomware, revil, Threat analysis
November 16, 2020

Malsmoke operators abandon exploit kits in favor of social engineering scheme

Exploit kits continue to be used as a malware delivery platform. In 2020, we’ve observed a number of different malvertising campaigns leading to RIG, Fallout, Spelevo and Purple Fox, among others. And, in September, we put out a blog post detailing a surge in malvertising via adult websites. One of those campaigns we dubbed ‘malsmoke’ had been active since the beginning of … [Read more...]

Filed Under: exploit kits, Exploits, Fallout, Malsmoke, malvertising, smoke loader, Social engineering, Threat analysis
November 4, 2020

QBot Trojan delivered via malspam campaign exploiting US election uncertainties

This blog post was authored by Jérôme Segura and Hossein Jazi. The 2020 US elections have been the subject of intense scrutiny and emotions, while happening in the middle of a global pandemic. As election night ended and uncertainty regarding the results began to creep in, threat actors decided to jump in on it too. Those tracking the threat landscape know very well that major world events … [Read more...]

Filed Under: cybercrime, elections, malspam, Pinkslipbot, Qakbot, Qbot, Social engineering, spam
October 28, 2020

Fake COVID-19 survey hides ransomware in Canadian university attack

This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero. In recent weeks, we’ve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishing document targeting staff at the University of British Columbia (UBC) with a fake COVID-19 … [Read more...]

Filed Under: cybercrime, phish, phishing, ransomware, Social engineering, UBC, university, vaggen
Next Page »