Malware

Pierluigi Paganini November 21, 2019
Microsoft warns of growing DoppelPaymer Ransomware threat

The Microsoft Security Response Center (MSRC) warned customers of the DoppelPaymer ransomware and provided useful information on the threat. The Microsoft Security Response Center (MSRC) warned customers of the DoppelPaymer ransomware, the tech giant provided useful information on the threat and how it spreads. “Microsoft has been investigating recent attacks by malicious actors using the Dopplepaymer ransomware. There is misleading information […]

Pierluigi Paganini November 21, 2019
Roboto, a new P2P botnet targets Linux Webmin servers

Security experts discovered a new peer-to-peer (P2P) botnet dubbed Roboto that is targeting Linux servers running unpatched Webmin installs. Researchers at 360Netlab discovered a new P2P botnet, tracked as Roboto, that is targeting Linux servers running unpatched installations of Webmin installs. The experts first spotted the Roboto botnet in August when they detected a suspicious […]

Pierluigi Paganini November 20, 2019
Monero Project website has been compromised to deliver a coin stealer

The official website of the Monero Project has been compromised to deliver a coin stealer. The official website of the Monero Project has been compromised to deliver a cryptocurrency stealer on November 18. The hack was discovered after a user downloaded a Linux 64-bit command line (CLI) Monero binary that was containing a coin stealer. […]

Pierluigi Paganini November 20, 2019
Ransomware Revival: Troldesh becomes a leader by the number of attacks

Ransomware accounted for over half of all malicious mailings in H1 2019, Troldesh aka Shade being the most popular tool among cybercriminals. Group-IB, a Singapore-based cybersecurity company: ransomware accounted for over half of all malicious mailings in H1 2019, detected and analyzed by Group-IB’s Computer Emergency Response Team (CERT-GIB), with Troldesh aka Shade being the most popular tool […]

Pierluigi Paganini November 18, 2019
New NextCry Ransomware targets Nextcloud instances on Linux servers

NextCry is a new ransomware that was spotted by researchers while encrypting data on Linux servers in the wild. Security experts spotted new ransomware dubbed NextCry that targets the clients of the NextCloud file sync and share service. The name comes from the extensions the ransomware appends to the filenames of encrypted files. The malicious code targets Nextcloud […]

Pierluigi Paganini November 17, 2019
Security Affairs newsletter Round 240

A new round of the weekly newsletter arrived! The best news of the week with Security Affairs Bad News: AI and 5G Are Expected to Worsen Cybersecurity Risks Boardriders and its subsidiarities QuikSilver and Billabong infected with ransomware Major ASP.NET hosting provider SmarterASP hit by ransomware attack Apple Mail stores parts of encrypted emails in […]

Pierluigi Paganini November 15, 2019
The Australian Parliament was hacked earlier this year

The computer network of Australian Parliament was hacked earlier this year, and hackers exfiltrated data from the computers of several elected officials. According to the Australian Broadcasting Corp (ABC), earlier this year hackers penetrated the computer network of Australian Parliament and stole data from the computers of several elected officials. The attack took place on […]

Pierluigi Paganini November 15, 2019
New TA2101 threat actor poses as government agencies to distribute malware

A new threat actor tracked as TA2101 is conducting malware campaigns using email to impersonate government agencies in the United States, Germany, and Italy. A new threat actor, tracked as TA2101, is using email to impersonate government agencies in the United States, Germany, and Italy to multiple families of malware, deliver ransomware, and banking Trojans. The […]

Pierluigi Paganini November 15, 2019
A new sophisticated JavaScript Skimmer dubbed Pipka used in the wild

Visa Payment Fraud Disruption warns of a new JavaScript skimmer dubbed Pipka used to siphon payment data from e-commerce merchant websites. Visa Payment Fraud Disruption warns of a new JavaScript skimmer dubbed Pipka that was used by crooks to steal payment data from e-commerce merchant websites. Experts discovered the Pipka while investigating an e-commerce website […]

Pierluigi Paganini November 14, 2019
Tracking Iran-linked APT33 group via its own VPN networks

APT33, the Iran-linked APT group, has been using multiple layers of obfuscation to run a dozen live C2 servers for extremely targeted attacks. APT33, the Iran-linked APT group, has been using multiple layers of obfuscation to run a dozen live C2 servers involved in extremely targeted malware attacks. The targeted malware campaigns aimed at organizations […]