Pierluigi Paganini
August 25, 2018
Security researchers at Proofpoint security have discovered a previously undocumented downloader tracked as AdvisorsBot that was involved in malicious email campaigns. AdvisorsBot was uncovered in malicious email campaigns, attributed to the TA555 threat actor, targeting hotels, restaurants, and telecommunications entities. The name âAdvisorsBotâ comes from the early command and control (C&C) domains that all contained the word […]
Pierluigi Paganini
August 24, 2018
A new cross-platform Mirai variant appeared in the threat landscape, this one has been created using an open-source project. Security experts from Symantec have spotted a new cross-platform Mirai variant that has been created with an open-source project. Mirai malware first appeared in the wild in 2016 when the expert MalwareMustDie discovered it in massive […]
Pierluigi Paganini
August 23, 2018
Malware researchers from ESET have published a detailed report on the latest variant of the Turla backdoor that leverages email PDF attachments as C&C. Malware researchers from ESET have conducted a new analysis of a backdoor used by the Russia-linked APT Turla in targeted espionage operations. The new analysis revealed a list of high-profile victims that was […]
Pierluigi Paganini
August 23, 2018
Check Point reported that organizations worldwide have been targeted with the Ryuk ransomware that was developed by North Korea-linked threat actor. Security experts from Check Point have uncovered a ransomware-based campaign aimed at organizations around the world conducted by North Korea-linked threat actor. The campaign appears as targeted and well-planned, crooks targeted several enterprises and encrypted hundreds […]
Pierluigi Paganini
August 23, 2018
Security researchers from Bitdefender have spotted a new Android spyware framework dubbed Triout that could be used to create malware with extensive surveillance capabilities. Bitdefender researchers have identified a new spyware framework can be used to spy into Android applications, it is tracked as Triout and first appeared in the wild on May 15. The researcher revealed that the command […]
Pierluigi Paganini
August 22, 2018
Kaspersky Labs detected a sophisticated piece of banking malware dubbed Dark Tequila that was used to target customers of several Mexican banks. Security experts from Kaspersky Labs have spotted a sophisticated strain of banking malware dubbed Dark Tequila that was used to target customers of several Mexican financial institutions. According to the researchers, the complex Dark Tequila malware […]
Pierluigi Paganini
August 20, 2018
The popular malware researchers Marco Ramilli has analyzed a malware that remained under the radar for more than two years. Today I’d like to share the following reverse engineering path since it ended up to be more complex respect what I thought. The full path took me about hours work and the sample covers many […]
Pierluigi Paganini
August 20, 2018
Researchers from Trustwave have uncovered a malspam campaign targeting banks with the FlawedAmmyy RAT. The peculiarity of this malspam campaign is the unusual use of a Microsoft Office Publisher file to infect victimsâ systems. Experts noticed an anomalous spike in the number of emails with a Microsoft Office Publisher file (a .pub attachment) and the subject line, âPayment Advice,â that was sent to domains belonging […]
Pierluigi Paganini
August 19, 2018
A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. Let me inform you that my new book, “Digging in the Deep Web” is online with a special deal 20% discount Kindle Edition Paper Copy Once again thank you! ·     DNS Hijacking targets Brazilian financial institutions ·     […]
Pierluigi Paganini
August 18, 2018
Researchers discovered a new modular downloader, tracked as Marap malware, that is being used in large campaigns targeting financial institutions. Researchers from Proofpoint have spotted a new modular downloader in large campaigns targeting financial institutions, experts believe the malicious code could be used to deliver additional malware in future attacks. Earlier August, Proofpoint reported several […]
