Inside of the WASP’s nest: deep dive into PyPI-hosted malware
Photo by Matheus Queiroz on Unsplash In late 2022 we decided to start monitoring PyPI, arguably the most important Python repository, as there were a number of reports on it hosting malware. PyPI took exceptional relevance amongst all repositories as, historically, it was trusted by default by many software developers. Any security breach or abuse […] more…APT43: An investigation into the North Korean group’s cybercrime operations
Introduction As recently reported by our Mandiant’s colleagues, APT43 is a threat actor believed to be associated with North Korea. APT43’s main targets include governmental institutions, research groups, think tanks, business services, and the manufacturing sector, with most victims located in the United States and South Korea. The group uses a variety of techniques and […] more…The Tetrade: Brazilian banking malware goes global
Introduction Brazil is a well-known country with plenty of banking trojans developed by local crooks. The Brazilian criminal underground is home to some of the world’s busiest and most creative perpetrators of cybercrime. Like their counterparts’ in China and Russia, their cyberattacks have a strong local flavor, and for a long time, they limited their […] more…Spam and phishing in Q1 2017
Spam: quarterly highlights Spam from the Necurs botnet We wrote earlier about a sharp increase in the amount of spam with malicious attachments, mainly Trojan encryptors. Most of that spam was coming from the Necurs botnet, which is currently considered the world’s largest spam botnet. However, in late December 2016, the network’s activity almost ceased […] more…Attack on Zygote: a new twist in the evolution of mobile threats
The main danger posed by apps that gain root access to a mobile device without the user’s knowledge is that they can provide access to far more advanced and dangerous malware with highly innovative architecture. We feared that Trojans obtaining unauthorized superuser privileges to install legitimate apps and display advertising would eventually start installing malware. […] more…TorrentLocker Surges in the UK, More Social Engineering Lures Seen
Analysis and data by Paul Pajares (Fraud Analyst) and Jon Oliver (Senior Architect) We’ve noticed a recent increase in TorrentLocker-related emails being sent to users in several countries, particularly the United Kingdom and Turkey. From the latter half of May until June 10, there was a relative lull in TorrentLocker-related emails. However, over a period of […] more…More information
- Are You Protecting the Data Packets in Your Pocket?
- Do Indians Ignore PC Protection And Think It Is Not Important Enough?
- S3 Ep75: Okta hack, CryptoRom, OpenSSL, and CafePress [Podcast]
- OpenSSF Receives $5 Million for Open Source Software Security Project
- Vulnerabilities in Popular Keyboard and Mouse Android Apps Expose User Data
- U.S. Attributes New Trojan to North Korean Hackers
- "I will not knit my own cryptography!" 60 Second Security
- The Dilemma of Anonymity and Dangers of Ask.fm
- Microsoft Secure Boot Could Ban Windows From PCs
- Update: Integrated Student Information System (ISIS) Hardware Failure