Macro Malware: When Old Tricks Still Work, Part 2
In the first part of this series, we discussed about the macro malware we have recently seen in the threat landscape. This second entry will delve deeper into the techniques or routines of macro malware. Unintended consequences Let us put things into perspective – by itself, macros are not harmful to the user. Its intended function is […] more…IT threat evolution in Q1 2015
Q1 in figures According to KSN data, Kaspersky Lab products detected and neutralized a total of 2,205,858,791 malicious attacks on computers and mobile devices in the first quarter of 2015. Kaspersky Lab solutions repelled 469,220,213 attacks launched from online resources located all over the world. Kaspersky Lab’s web antivirus detected 28,483,783 unique malicious objects: scripts, […] more…Rombertik malware destroys computers if detected
A new type of malware resorts to crippling a computer if it is detected during security checks, a particularly catastrophic blow to its victims. The malware, nicknamed Rombertik by Cisco Systems, is designed to intercept any plain text entered into a browser window. It is being spread through spam and phishing messages, according to Cisco’s […] more…Enterprises Hit by BARTALEX Macro Malware in Recent Spam Outbreak
Enterprises are currently being targeted by the macro malware BARTALEX in a recent outbreak of thousands of spammed emails. The infection routine for BARTALEX uses a Microsoft Word document and social engineering lure that is widely recognized by enterprises—making infection all too possible. This attack highlights how macro malware in Microsoft Office files is fast becoming […] more…How Targeted Attacks Changed in 2014
2014 was a year in which we saw further refinements in targeted attack methodologies. As more organizations upgraded to newer versions of Windows, we saw the increased use of 64-bit malware in several campaigns. Examples of 64-bit malware include HAVEX, a remote access Trojan (RAT) used in a campaign that targeted industrial control systems (ICS), and WIPALL, […] more…Digital Certificates: Who Can You Trust?
Digital certificates are the backbone of the Public Key Infrastructure (PKI), which is the basis of trust online. Digital certificates are often compared to signatures; we can trust a document because it has a signature, or certificate authority (CA) by someone we trust. Simply put, digital certificates are a reproduction of a simple model which occurs […] more…The Banking Trojan Emotet: Detailed Analysis
Introduction In the summer of 2014, the company Trend Micro announced the detection of a new threat – the banking Trojan Emotet. The description indicated that the malware could steal bank account details by intercepting traffic. We call this modification version 1. In the autumn of that year a new version of Emotet was found. […] more…NewPosThings Has New PoS Things
Arbor Networks initially posted about a new point-of-sale (PoS) malware family named NewPosThings last September, which we detect as either TSPY_POSNEWT.SM or TSPY_POSNEWT.A. We are now seeing new developments in this area—namely, versions for 64-bit and higher. The 64-bit version is out Similar to the previous 32-bit version reported last year, the 64-bit sample is […] more…Crypto-Ransomware Sightings and Trends for 1Q 2015
It seems that cybercriminals have yet to tire of creating crypto-ransomware malware. Since the start of 2015, we have spotted several variants of crypto-ransomware plague the threat landscape. In January, the Australia-New Zealand region was beset by variants of TorrentLocker. But we soon discovered that TorrentLocker infections were not limited to that region; Turkey, Italy, […] more…Why Website Reinfections Happen
I joined Sucuri a little over a month ago. My job is actually as a Social Media Specialist, but we have this process where regardless of your job you have to learn what website infections look like and more importantly, how to clean them. It’s this idea that regardless of you are you must always […] more…Inside the EquationDrug Espionage Platform
Introduction EquationDrug is one of the main espionage platforms used by the Equation Group, a highly sophisticated threat actor that has been engaged in multiple CNE (computer network exploitation) operations dating back to 2001, and perhaps as early as 1996. (See full report here [PDF]). EquationDrug, which is still in use, dates back to 2003, […] more…Samba Remote Code Execution Vulnerability – CVE-2015-0240
The Samba team reported CVE-2015-0240 last February 23, 2015. This vulnerability is very difficult to exploit and we are not aware of successful exploitation. However, it is quite interesting from the point for view of detection. There are two important facts: The vulnerability resides in the Netlogon Remote Protocol implementation of Samba which is a […] more…Why Websites Get Hacked
I spend a good amount of time engaging with website owners across a broad spectrum of businesses. Interestingly enough, unless I’m talking large enterprise, there is a common question that often comes up: Why would anyone ever hack my website? Depending on who you are, the answer to this can vary. Nonetheless, it often revolves […] more…Notorious Malware Improvements and Enhancements of 2014
2014 was a year that was marked with numerous changes in the threat landscape. We saw a lot of improvements in existing malware, either with new evasion techniques or versions. We even saw some old techniques and attacks resurface in the landscape. Evasion Tactics We are seeing more malware incorporate Tor in their routines as […] more…BE2 Extraordinary Plugins, Siemens Targeting, Dev Fails
Our November post introducing our BlackEnergy2 (BE2) research described new findings on the group’s activity. We presented both details on their plugins and significant findings about some of their targets and victims. In this post, let’s examine several additional plugins more closely, targeting details around BE2 Siemens exploitation, and some of their unusual coding failures. We […] more…CTB-Locker Ransomware Spoofs Chrome and Facebook Emails as Lures, Linked to Phishing
We recently talked about recent improvements to the CTB-Locker ransomware. To recap, the malware now offers a “free decryption” service, extended deadline to decrypt the files, and an option to change the language of the ransom message. We are seeing another wave of CTB-Locker ransomware making their way into the wild. What’s highly notable about […] more…More information
- Fake Windows Update Delivers Cyborg Ransomware
- iPhone thief posts picture of himself seemingly smoking pot on victim’s Facebook page
- BrakTooth: New Bluetooth Vulnerabilities Could Affect Millions of Devices
- ‘HackerOne’: Microsoft and Facebook to offer app and web bug bounties
- Yelp invites hackers to expose vulnerabilities through bug bounty program
- SpaceX is about to launch one of its final expendable rockets
- Cyberattack Simulation Company XM Cyber Raises $17 Million
- Most Fancy Bear hacking targets weren’t warned by FBI
- Security experts push back at ‘Cyber Pearl Harbor’ warning
- Nvidia may abandon its $40B ARM acquisition