dcsimg
July 21, 2020

Chinese APT group targets India and Hong Kong using new variant of MgBot malware

This blog post was authored by Hossein Jazi and Jérôme Segura On July 2, we found an archive file with an embedded document pretending to be from the government of India. This file used template injection to drop a malicious template which loaded a variant of Cobalt Strike. One day later, the same threat actor changed their template and dropped a loader called MgBot, executing and injecting … [Read more...]

Filed Under: APT, china, chinese apt, government of india, hong kong, india, loader, MgBot, mgbot malware, state sponsored cyberattack, Threat analysis
July 17, 2020

It’s baaaack: Public cyber enemy Emotet returns to terrorize more victims

This blog post was authored by Jérôme Segura and Hossein Jazi After over four months of absence, the dreaded Emotet has returned with a vengeance. Following several false alarms over the last few weeks, a spam campaign was first spotted on July 13 showing signs of a likely comeback. The Emotet botnets started pushing malspam actively on Friday, July 17, using the same techniques as before. … [Read more...]

Filed Under: emotet, spam, Trojans
June 17, 2020

Multi-stage APT attack drops Cobalt Strike using Malleable C2 feature

This blog post was authored by Hossein Jazi and Jérôme Segura On June 10, we found a malicious Word document disguised as a resume that uses template injection to drop a .Net Loader. This is the first part of a multi-stage attack that we believe is associated to an APT attack. In the last stage, the threat actors used Cobalt Strike’s Malleable C2 feature to download the final payload and … [Read more...]

Filed Under: APT, C2, cobalt strike, Malleable C2, Malware, Threat analysis
June 10, 2020

Honda and Enel impacted by cyber attack suspected to be ransomware

Car manufacturer Honda has been hit by a cyber attack, according to a report published by the BBC, and later confirmed by the company in a tweet. Another similar attack, also disclosed on Twitter, hit Edesur S.A., one of the companies belonging to Enel Argentina which operates in the business of energy distribution in the City of Buenos Aires. Based on samples posted online, these incidents may … [Read more...]

Filed Under: ekans, enel, honda, ransomware, Snake, Threat analysis
June 4, 2020

New LNK attack tied to Higaisa APT discovered

This post was authored by Hossein Jazi and Jérôme Segura On May 29th, we identified an attack that we believe is part of a new campaign from an Advanced Persistent Threat actor known as Higaisa. The Higaisa APT is believed to be tied to the Korean peninsula, and was first disclosed by Tencent Security Threat Intelligence Center in early 2019. The group’s activities go back to at least … [Read more...]

Filed Under: APT, Higaisa, korea, LNK, Malware, PlugX, rat, Threat analysis
May 21, 2020

Shining a light on “Silent Night” Zloader/Zbot

When it comes to banking Trojans, ZeuS is probably the most famous one ever released. Since its source code originally leaked in 2011, several new variants proliferated online. That includes a past fork called Terdot Zbot/Zloader, which we extensively covered in 2017. But recently, we observed another bot, with a design reminiscent of ZeuS, that seems to be fairly new (a 1.0 version was … [Read more...]

Filed Under: banking Trojan, banking Trojans, HYAS, Malware, silent night, terdot, Threat analysis, zbot, Zeus, Zloader
May 6, 2020

New Mac variant of Lazarus Dacls RAT distributed via Trojanized 2FA app

This blog post was authored by Hossein Jazi, Thomas Reed and Jérôme Segura. We recently identified what we believe is a new variant of the Dacls Remote Access Trojan (RAT) associated with North Korea’s Lazarus group, designed specifically for the Mac operating system. Dacls is a RAT that was discovered by Qihoo 360 NetLab in December 2019 as a fully functional covert remote access … [Read more...]

Filed Under: APT, Dacls, Lazarus, Mac, Malware, rat, Threat analysis, tinkaOTP
April 9, 2020

APTs and COVID-19: How advanced persistent threats use the coronavirus as a lure

The coronavirus (Covid-19) has become a global pandemic and this is a golden time for attackers to take advantage of this fear to increase the likelihood of their attacks success rate by performing spam and spear phishing campaigns. From late January, several cyber-criminal and state-sponsored groups have begun using coronavirus-based phishing as their infection vectors to gain a foothold on … [Read more...]

Filed Under: advanced persistent threats, APTs, covid-19, Malware, Threat analysis
April 7, 2020

Copycat criminals abuse Malwarebytes brand in malvertising campaign

While exploit kit activity has been fairly quiet for some time now, we recently discovered a threat actor creating a copycat—fake—Malwarebytes website that was used as a gate to the Fallout EK, which distributes the Raccoon stealer. The few malvertising campaigns that remain are often found on second- and third-tier adult sites, leading to the Fallout or RIG exploit kits, as a majority of … [Read more...]

Filed Under: copycat criminals, copycat sites, exploit kit, exploit kits, Exploits and vulnerabilities, fake malwarebytes site, Fallout, Fallout EK, malvertising, malvertising campaign, malvertising campaigns, Malwarebytes, Raccoon, raccoon stealer, threat actors
March 23, 2020

Fake “Corona Antivirus” distributes BlackNET remote administration tool

Scammers and malware authors are taking advantage of the coronavirus crisis in full swing. We have seen a number of spam campaigns using COVID-19 as a lure to trick people into installing a variety of malware, but especially data stealers. As more of us work from home, the need to secure your computer, especially if you are connecting to your company’s network, becomes more important. … [Read more...]

Filed Under: antivirus, botnet, coronavirus, covid-19, fake, Malware, rat, Social engineering, Threat analysis
Next Page »