malware

Pierluigi Paganini August 12, 2019
Flaws in device drivers from 20 vendors allow hackers to install a persistent backdoor

Researchers discovered multiple flaws in more than 40 device drivers from at least 20 different vendors that could to install a persistent backdoor on Windows PCs. Experts at firmware security firm Eclypsium have conducted a study on the device drivers from major vendors and discovered serious issues in over 40 drivers from 20 companies. The […]

Pierluigi Paganini August 11, 2019
Security Affairs newsletter Round 226

A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs Hi folk, let me inform you that I suspended the newsletter service, anyway I’ll continue to provide you a list of published posts every week through the blog. Once again thank you! DealPly adware abuses reputation services to remain […]

Pierluigi Paganini August 09, 2019
Emsisoft released a free decryptor for JSWorm 4.0

Security researchers at Emsisoft have released a new decryptor tool that allows the victims of the JSWorm 4.0 ransomware to decrypt their files for free. Thanks to the experts at Emsisoft the victims of the JSWorm 4.0 ransomware can decrypt their files for free. Like previous versions of the malware, the JSWorm 4.0 ransomware is […]

Pierluigi Paganini August 06, 2019
The Evolution of Aggah: From Roma225 to the RG Campaign

The experts at Yoroi-Cybaze ZLab discovered a new wave of attacks linked to the cyber espionage campaign tracked as Roma225. Introduction Few months ago we started observing a cyber operation aiming to attack private companies in various business sectors, from automotive to luxury, education, and media/marketing.  The attack attribution is still unclear but the large scale of […]

Pierluigi Paganini August 05, 2019
GermanWiper, a data-wiping malware that is targeting Germany

Recently a data-wiping malware tracked as GermanWiper has been targeting German organizations, the malicious code is pushed via phishing messages. GermanWiper is being distributed in Germany through spam messages that pretend to be emails sent by a job applicant named Lena Kretschmer that is submitting her resume. The messages have the subject “Ihr Stellenangebot – Bewerbung [Your job offer – […]

Pierluigi Paganini August 04, 2019
Houston County Schools in Alabama delayed the school year’s opening due to a malware attack

It has happened again, for the second time in a few days, Houston County Schools in Alabama delayed the school year’s opening due to a malware attack. The long wave of malware attacks against US schools continues, for the second time in a week, the Houston County Schools in Alabama delayed the school year’s opening scheduled for […]

Pierluigi Paganini August 04, 2019
DealPly adware abuses reputation services to remain under the radar

Malware researchers from enSilo have spotted a new variant of the DealPly adware that uses a new method to avoid detection. Researchers from enSilo have discovered a new variant of the modular DealPly adware that abuses the reputation services provided by Microsoft’s SmartScreen (aka Windows Defender SmartScreen) and McAfee’s WebAdvisor to avoid detection. The main […]

Pierluigi Paganini August 03, 2019
SystemBC, a new proxy malware is being distributed via Fallout and RIG EK

Researchers at Proofpoint discovered SystemBC, a new strain of proxy malware that is being distributed via Fallout and RIG Exploit Kits A new piece of malware dubbed SystemBC was discovered by experts at Proofpoint, it is being distributed via exploit kits like Fallout and RIG. The malware was tracked as “SystemBC” based on the URI path […]

Pierluigi Paganini July 27, 2019
No More Ransom project has helped victims to save $108 million of ransom

Over the past three years, the website of No More Ransom was visited by 3 million users and allowed to save $108 million in ransom to the victims of 109 ransomware. After three years, No More Ransom confirms the success of the initiative that aims at helping victims of ransomware. The No More Ransom was […]

Pierluigi Paganini July 27, 2019
Hackers inject Magecart multi-gateway skimmer in fake Google domains

Attackers deployed a Magecart credit card skimmer script into fake Google domains used to trick visitors into making online transactions.  Experts at Sucuri discovered threat actors using fake Google domains hosting a Magento skimmer script used to steal payment data when unaware visitors make transactions. The campaign was uncovered when the owner of a website […]