Attack on Zygote: a new twist in the evolution of mobile threats
...the above servers are unavailable, from a list of reserve command servers also written in the code: bridgecr1.tailebaby.com:8088 bridgecr2.tailebaby.com:8088 bridgecr3.tailebaby.com:8088 bridgecr4.tailebaby.com:8088 bridgecr1.hanltlaw.com:8088 bridgecr2.hanltlaw.com:8088 bridgecr3.hanltlaw.com:8088 bridgecr4.hanltlaw.com:8088 In reply, an encrypted configuration... more…Ztorg: money for infecting your smartphone
...of new users each day! For example, com.fluent.led.compass had 10,000–50,000 installations the day I found and reported it to Google. However, it still wasn’t deleted from Google Play the next... more…SPAM Hack Targets WordPress Core Install Directories
...by doing some Google searches: http://www.immunomix.com/ITIpress/wp-includes/finance/paydayloan/payday-loans-instant.htmlhttp://microwaveamps.co.uk/wp-includes/js/thickbox/lib/loans/payday-loans-in-london-uk.htmlhttp://www.scifidimensions.com/wp-includes/finance/cashadvance/cash-advance-loan-lenders.htmlhttp://www.beereading.com/wp-includes/finance/cashadvance/cash-advance-loans.htmlhttp://vastema.com/wp-includes/cheap-hermes-lindy-bags-on-sale.htmlhttp://www.antibabypillerezeptfrei.net/wp-includes/js/crop/advancement/helpers/blrmalaysiabank.htmlhttp://todayscliche.com/wp-includes/palco.html http://www.ethosindia.com/wp-includes/mambo.php?p=55http://www.turnerforte.com/blog/wp-includes/finance/cashadvance/cash-advance-credit.htmlhttp://www.ednapletonblog.com/wp-includes/werty/replica-36596.htmlhttp://www.pettycustomhomes.com/wp-includes/cheap-kids-nba-jerseys-3167596.htmlhttp://www.pondproshop.com/reference/wp-includes/catalog/services/vybe/vybe-band-reviews.htmlhttp://firefly-path.net/wp-includes/pomo/qwe/4/Buy-Balenciaga-High-Quality-Replica-Clutches.phphttp://wolfgangcapellari.com/wp-includes/pomo/rolex-imitation.htmlhttp://byphandyman.com.au/wp-includes/people/replica-bvlgari-fake-watches.htmlhttp://rumbaytimbal.com/wp-includes/reviews/http://www.preservinggoodstock.com/wp-includes/louis-vuitton-bags-5641302.htmlhttp://www.domagojkovacic.com/wp-includes/wholesale-jerseys-from-china-7479567.htmlhttp://maciejkot.pl/wp-includes/detect.htmlhttp://allinseopack.com/wp-includes/js/plupload/oscar-leeser-bio-i12.comhttp://www.marinavendrell.com/wp-includes/store/diet/solpria/solpria-cleanse-reviews.htmlhttp://missouriche.org/wp-includes/louisvuitton19.htmlhttp://vastema.com/wp-includes/replica-hermes-birkin-25-cm.htmlhttp://www.conemund.org/eng/wp-includes/replica.phphttp://cri-technologies.com/wp-includes/pomo/mkheaf.php?psdjvwei=uplink%20dwdhttp://www.giser.net/wp-includes/headt.phphttp://chicksdigme.com/wp-includes-old/vanilla-sky-lyrics-owl-city-i0.comhttp://jewelrypictures.org/wp-includes/js/imgareaselect/ghd-machine-i5.comhttp://www.jobshopsf.com/wp/wp-includes/finance/autoloan/car-loan.htmlhttp://www.ebrice.com/wp-includes/shop/health/tagaway/buy-tag-away-discount-price.htmlhttp://amr-nadim.net/wp-includes/fake-hermes-clic-clac-bracelet–5621.htmlhttp://jesicaglot.com.ar/wp-includes/news/replica-watches_14626.htmlhttp://funaki.ens-serve.net/wp-includes/images/news/black-evening-dresses.htmlhttp://linkarbeid.no/wp-includes/replica-celine-tas.htmlhttp://www.iwillstandupforyou.com/wp-includes/nfljerseys-19244-6847676.htmlhttp://www.viparenda.com.ua/wp-includes/pomo/index/shorewatches.htmhttp://www.lelieuunique.com/site/wp-includes/wp-about.php?p=124-chaussure-christian-louboutin-pas-cher.htmlhttp://redtouch.com.mt/wp-includes/news/oris-aquis-depth-gauge-replica-watch-hands-on.htmlhttp://www.stridesforstars.com/wp-includes/rewrite/list.html http://perfectgroup.se/wp-includes/replica/rolexhttp://www.cowalrugby.co.uk/wp-includes.phphttp://janmccraylaw.com/wp-includes/watches/replica-32802.htmlhttp://bekarty.pl/wp-includes/be/cartier-swiss-replica.htmlhttp://conceitorio.com.br/home/wp-includes/indo/rolex-airking.htmlhttp://www.liftstudios.ca/wp-includes/images/arrows/lib/chanel/wallets/Chanel-Wallet-On-a-Chain-Replica.phphttp://mag.amazing-kids.org/wp-includes/js/crop/lib/vuitton/LV-Bags/Louis-Vuitton-Overnight-Bags-Replica.phphttp://atelier.aencre.org/wp-includes/js/thickbox/lib/louboutin/model/christian-louboutin-crystal-daffodil-pumps-replica.phphttp://feo.nusta.com.ua/wp-includes/images/news/buswatches.htmhttp://cafetaxa.dk/wp-includes/replica-watches-uk/http://www.socialned.nl/wp-includes/php/tag/michael-kors-outlet-washingtonhttp://podcasttennis.free.fr/wordpress/wp-includes/js/tinymce/themes/advanced/ejezuli/inig/http://www.baypointmarina.com/wp-includes/brand/ralph-lauren-sleepwear.htmlhttp://nsldigest.org/wp-includes/css/wp-pointer/Buy-Good-Replica-Louis-Vuitton-Shoes_25510.htmlhttp://supportambitiongroup.com/wp-includes/css/download-free-porn-no-sign-up.phphttp://icmcc.org/wp-includes/js/jcrop/gearshifter.php?dqq=506http://w3f.pl/wp-includes/pomo/silagra-50-price.htmlhttp://www.fedusa.org.za/wp-includes/js/tinymce/wp-mce-help.phphttp://www.styleslicker.com/wp-includes/js/buytadalafil/index.php?page=4http://nclarkplaning.co.uk/blog/wp-includes/Cardiovascular/ventolin-mdi-buy.htmlhttp://www.cadillacpizzapub.com/livemusic/wp-includes/finance/creditscore/annual-credit-score.htmlhttp://www.nagaloka.org/wp-includes/filesd/1137a750e374cebd95e7bfb4c05c60a0http://www.immunomix.com/ITIpress/wp-includes/finance/creditreport/credit-report-and-score.htmlhttp://www.elpaisdealtamira.es/wp-includes/js/crop/lib/vuitton/LV-Replica/Louis-Vuitton-Replica-AAA.phphttp://yogagals.com/wp-includes/bottega-veneta.htmlhttp://www.baypointmarina.com/wp-includes/brand/ralph-lauren-bicester-village.htmlhttp://nrca-railroad.com/wp-includes/js/crop/_notes/vuitton/LV-Outlets/Louis-Vuitton-Outlet-Store-in-Kansas-City-Missouri-MO.phphttp://www.madeleineking.co.uk/wp-includes/the-wine-house-lichfield-i10.comhttp://www.mecalfab.com/mecalfab1/wp-includes/discountstore/kitchen/ninjamegablender/mega-ninja-blender.htmlhttp://oisa.org/trl/wp-includes/onlineshop/naturalproducts/powerprecision/buy-power-precision-lean-muscle-formula.htmlhttp://www.elpaisdealtamira.es/wp-includes/js/crop/lib/vuitton/LV-Replica/Louis-Vuitton-Replica-AAA.phphttp://adamriemer.me/wp-includes/user/index.php?p=netflix-rentals-netflix-dvd-moviehttp://adcaustintech.com/javaegl/wp-includes/user/index.php?p=netflix-shareshttp://todomejora.org/wp-includes/js/crop/lib/loans/payday-loans-without-checking-account-requirements.htmlhttp://www.thekookmovie.com/wp-includes/phphttp://www.moorefinefoods.com/wp-includes/heads7.htmlhttp://www.businsure.com.au/wp-includes/jordanretroretails.com.htmlhttp://www.airjordanpaschererfr.com/http://stoleti.cz/wp-includes/images/index.phphttp://www.chriswind.net/wp-includes/nets1121.htmlhttp://icmcc.org/wp-includes/js/jcrop/gearshifter.php?dqq=196http://www.demalagana.es/wp-includes/jordan11spacejambox.com.htmlhttp://www.iarld.com/wp-includes/sageron.htmlhttp://www.maintenantlagauche.com/wp-includes/class-wp-login.phphttp://www.thesinbin.ca/wp-includes/images/jordansbred-us.com.htmlhttp://www.plantingdandelions.com/wp-includes/x-jordan.htmlhttp://www.martaortells.com/wordpress/wp-includes/images/jordansinfrared.com.htmlhttp://missouriche.org/wp-includes/nikefree11.htmlhttp://www.accqtrak.com/WordPress/wp-includes/Text/Diff/Renderer/Year57.phphttp://urbancampout.com/wp-includes/glass.phphttp://kortshoes.nl/wp-includes/The/fake-replica-watches.htmlhttp://wolfgangcapellari.com/wp-includes/pomo/rolex-imitation.htmlhttp://vastema.com/wp-includes/buy-hermes-lindy-handbags-outlet.htmlhttp://maciejkot.pl/wp-includes/detect.htmlhttp://nrca-railroad.com/wp-includes/js/crop/_notes/vuitton/LV-Buy/Buy-Louis-Vuitton-in-Warsaw-Poland.phphttp://www.elpaisdealtamira.es/wp-includes/js/crop/lib/vuitton/LV-Cheap/Cheap-Louis-Vuitton-Luggage-Knock-Off.phphttp://dibach.com/wp-includes/Text/Lifestyle/dating-lord-elgin-watches.phphttp://www.iwillstandupforyou.com/wp-includes/real-gucci-belt-for-men-cheap-8163353.htmlhttp://www.missouriche.org/wp-includes/index.htmlhttp://www.lonestarlandscaping.biz/wp-includes/store/diet/greencoffee/where-can-i-buy-green-coffee-bean.htmlhttp://www.andersonmontana.com/test/wp-includes/Text/Diff/Renderer/Filter17.phphttp://www.cerbone.com/wp-includes/store/exercise/contourabs/contour-abs-reviews.htmlhttp://www.smkgear.com/_wp/wp-includes/discountstore/home/solaramerica/solar-america-home-power-station.html This is a very small sample. A quick search on Google using inurl:/wp-includes viagra levitra cialis reveals more than 13,000 pages. As... more…FIN7.5: the infamous cybercrime rig “FIN7” continues its activities
...under a “new” brand, “IPC”. More information about these and related attacks is available to customers of Kaspersky Intelligence Reports. Contact: intelreports@kaspersky.com Indicators of compromise AveMaria 185.61.138.249 tain.warzonedns[.]com noreply377.ddns[.]net 185.162.131.97... more…Website Mesh Networks Distributing Malware
...web sites: X.com, Y.com and Z.com. Homer injects malware into X.com that then loads from Y.com. The malware from Y.com is loaded from Z.com and the one from Z.com is... more…Blog Comments – Analysing 100,000 Comments and Spammers
...field, they add a link to their own web site (which can increase their page rankings, visitors, etc). Example: [author] => Mary Jane [email] => info@fabfunapps.com [url] => http://fabfunapps.com [comment]... more…Conditional Malicious iFrame Targeting WordPress Web Sites
...one: sitylertudes.abbotaleweekendgetaway.com HTTP/1.1 302 Found Server: nginx Date: Sat, 13 Sep 2014 02:05:29 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 370 Connection: keep-alive Set-Cookie: ehihm=7MMcADE2AAIAAgBpphNU__9pphNUQAABAAAAaaYTVAA-; expires=Sun, 13-Sep-2015 02:05:29 GMT; path=/; domain=dolberop.chrisxp.us Location:... more…The “EyePyramid” attacks
...domains outlined by the police report follow: E-mail Addresses used for exfiltration gpool@hostpenta[.]com hanger@hostpenta[.]com hostpenta@hostpenta[.]com purge626@gmail[.]com tip848@gmail[.]com dude626@gmail[.]com octo424@gmail[.]com tim11235@gmail[.]com plars575@gmail[.]com Command-and-Control Servers eyepyramid[.]com hostpenta[.]com ayexisfitness[.]com enasrl[.]com eurecoove[.]com marashen[.]com millertaylor[.]com... more…New Version of XLoader That Disguises as Android Apps and an iOS Profile Holds New Links to FakeSpy
...to apps, and detects and blocks malware and access to fraudulent websites. Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b com.dhp.ozqh Facebook... more…Darkleech + Bitly.com = Insightful Statistics
...Here is the VirusTotal analysis of the .so file that does it. Looks the same. But you’ll notice that now it uses shortened bitly.com links in the iFrames. Bitly (aka... more…Website Malware – Mobile Redirect to BaDoink Porn App
...A few weeks ago we reported that we were seeing a huge increase in the number of web sites compromised with a hidden redirection to pornographic content. It was... more…‘Twas the night before
...Recently, the United States Cyber Command (USCYBERCOM Malware Alert @CNMF_VirusAlert) highlighted several VirusTotal uploads of theirs – and the executable objects relating to 2016 – 2017 NewsBeef/APT33 activity... more…New(ish) Mirai Spreader Poses New Risks
...Based on multiple artefacts, the word choice from string artefacts, the code having been compiled on a Chinese system, that the host servers are maintained in Taiwan, abuse of stolen... more…Uncovering the Inner Workings of EyePyramid
...accounts were stolen, with email accounts from the following domains being targeted: The domains being targeted @alice.it @aol.com @att.net @badoo.com @bellsouth.net @bluewin.ch @btinternet.com @comcast.net @cox.net @cyh.com.tr @earthlink.net @eim.ae @email.com @email.it... more…Gaza Cybergang Group1, operation SneakyPastes
...For more information, please contact: intelreports@kaspersky.com Summary Gaza Cybergang Group1, described in this post, is the least sophisticated of the three attack groups and relies heavily on the use of... more…New GnatSpy Mobile Malware Family Discovered
...com.app.voice Voice 1b1bff4127c9f868f14bc8f2526358cfc9ff1259b7069ab116e7c52e43f2c669 com.messenger.hike Android Setting 1c0e3895f264ac51e185045aa2bf38102da5b340eb3c3c3f6aacb7476c294d62 com.app.updates Messenger Update 22078e0d00d6a0f0441b3777e6a418170e3a9e4cce8141f0da8af044fdc1e266 com.myapps.update Facebook Update 232807513c2d3e97bfcc64372d360bd9f7b6b782bd4083e91f09f2882818c0c5 com.myapps.update WhatsApp Update 313ae27ec66e533f7224d99c1a0c254272818d031456359d3dc85f02f21fd992 com.app.go Android Setting 377716c6a2b73c94d3307e9f2ea1a5b3774fa42df452c0867e7384eb45422e4f com.apps.voice Android Setting 3c604f5150ea1af994e7411e2816c277ff4f8a02b94d50b6cf4cc951430414bf com.appdev.update Android System... more…Kam dál?
- Watching Out For Typhoon Haiyan Scams
- Researcher sidesteps Microsoft fix for IE zero-day
- Amazon turns Cloud Drive into a Dropbox rival with file syncing
- Core Wireless Network Opitmization
- Docker Boosts Security for Containerized Applications
- Buffalo updates NAS systems with preloaded Trend Micro antivirus
- Apple CEO Tim Cook: FBI asked us to make software ‘equivalent of cancer’
- TrueCrypt security audit is good news, so why all the glum faces?
- Resolved: Webmail/email.psu.edu in a degraded state
- Experts Doubt Russia Used Malware to Track Ukrainian Troops