Malware

Pierluigi Paganini April 27, 2021
Shlayer macOS malware abuses zero-day to bypass Gatekeeper feature

Apple addresses a zero-day in macOS exploited by Shlayer malware to bypass Apple’s security features and deliver second-stage malicious payloads. Apple has addressed a zero-day flaw in macOS that was exploited by Shlayer malware to bypass Apple’s File Quarantine, Gatekeeper, and Notarization security checks and download second-stage malicious payloads. The developers behind the Shlayer malware have successfully […]

Pierluigi Paganini April 26, 2021
Bye Bye Emotet, law enforcement pushed the uninstall code via the botnet

European law enforcement has conducted an operation aimed at performing a mass-sanitization of computers infected with the infamous Emotet Windows malware. European law enforcement agencies automatically wiped the infamous Emotet malware from infected systems across the world as part of a mass sanitization operation. Early this year, law enforcement and judicial authorities worldwide conducted a […]

Pierluigi Paganini April 26, 2021
Prometei botnet is targeting ProxyLogon Microsoft Exchange flaws

Attackers are exploiting the ProxyLogon flaws in Microsoft Exchange to recruit machines in a cryptocurrency botnet tracked as Prometei. Experts from the Cybereason Nocturnus Team have investigated multiple incidents involving the Prometei Botnet. The attackers hit companies in North America and threat actors exploited the ProxyLogon Microsoft Exchange flaws (CVE-2021-27065 and CVE-2021-26858) to deliver malware in their networks. Attackers […]

Pierluigi Paganini April 24, 2021
ToxicEye RAT exploits Telegram communications to steal data from victims

ToxicEye is a new Remote Access Trojan (RAT) that exploits the Telegram service as part of it command and control infrastructure. ToxicEye RAT is a new malware that leverages the Telegram services for command & control, experts from Check Point already observed iover 130 attacks recorded in the past three months.  The use of the […]

Pierluigi Paganini April 24, 2021
A new Linux Botnet abuses IaC Tools to spread and other emerging techniques

A new Linux botnet uses Tor through a network of proxies using the Socks5 protocol, abuses legitimate DevOps tools, and other emerging techniques. Researchers from Trend Micro have spotted a new Linux botnet employing multiple emerging techniques among cyber-criminals, including the use of Tor proxies, the abuse of legitimate DevOps tools, and the removal or deactivation of competing […]

Pierluigi Paganini April 23, 2021
New Qlocker ransomware infected hundreds of QNAP NAS devices in a few days

A new ransomware strain dubbed Qlocker is infecting hundreds of QNAP NAS devices every day and demanding a $550 ransom payment. Experts are warning of a new strain of ransomware named Qlocker that is infecting hundreds of QNAP NAS devices on daily bases. The malware moves all files stored on the device to password-protected 7zip […]

Pierluigi Paganini April 23, 2021
Darkside Ransomware gang aims at influencing the stock price of their victims

The Darkside ransomware gang is enhancing its extortion tactics to interfere with the valuation of stocks of companies that are listed on NASDAQ or other stock markets. The Darkside ransomware operators are stepping up their extortion tactics targeting companies that are listed on NASDAQ or other stock markets with a new technique. The group announced […]

Pierluigi Paganini April 22, 2021
Pareto Botnet, million infected Android devices conduct fraud in the CTV ad ecosystem

Researchers from Human Security have uncovered a huge botnet of Android devices being used to conduct fraud in the connected TV advertising ecosystem. Security researchers at Human Security (formerly White Ops) discovered a massive Android botnet, dubbed Pareto, used to conduct fraud in the Connected TV (CTV) advertising ecosystem. The Pareto botnet is composed of […]

Pierluigi Paganini April 22, 2021
Million-dollar deposits and friends in high places: how we applied for a job with a ransomware gang

During an undercover interview, a CyberNews researcher tricked ransomware operators affiliated with Ragnar Locker into revealing their ransom payout structure, cash out schemes, and target acquisition strategies. From a relatively rare threat just a few years ago to one of the biggest moneymakers for cybercriminals today – the meteoric rise of ransomware has cast a shadow of […]

Pierluigi Paganini April 21, 2021
WhatsApp Pink malware spreads via group chat messages

A WhatsApp malware dubbed WhatsApp Pink is able to automatically reply to victims’ Signal, Telegram, Viber, and Skype messages. A WhatsApp malware dubbed WhatsApp Pink has now been updated, authors have implemented the ability to automatically respond to victims’ Signal, Telegram, Viber, and Skype messages. WhatsApp Pink is a fake app that was first discovered this week, […]