Research | Security I Trust

Irish business held to ransom

March 5, 2010 Blog 0 Comments

The latest trend is no longer to hack for fun but to hack to make money. Cyber Criminals (Hackers) have

AESDDoS Botnet Malware Infiltrates Containers via Exposed Docker APIs June 14, 2019
By David Fiser, Jakub Urbanec and Jaromir Horejsi Misconfiguration is not novel. However, cybercriminals still find that it is an effective way to get their hands on organizations’ computing resources to use for malicious purposes and it remains a top security concern. In this blog post, we will detail an attack type where an API... […]
Advanced Targeted Attack Tools Found Being Used to Distribute Cryptocurrency Miners June 13, 2019
We recently came across evidence of a large-scale cybercrime activity that appears to combine targeted attack tools and regular cybercrime: The attackers distribute typical malware such as cryptocurrency miners and ransomware by making use of sophisticated tools that were previously mostly seen in targeted attacks. The post Advanced Targeted Attack Tools Found Being Used to […]
Outlaw Hacking Group’s Botnet Observed Spreading Miner, Perl-Based Backdoor June 13, 2019
One of our honeypots detected a URL spreading a botnet with a Monero miner bundled with a Perl-based backdoor component. The routine caught our attention as the techniques employed are reminiscent as those used in the Outlaw hacking group’s previous operation. The post Outlaw Hacking Group’s Botnet Observed Spreading Miner, Perl-Based Backdoor appeared first on […]
Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns June 12, 2019
In TA505 group's latest campaign, they started using HTML attachments to deliver malicious .XLS files that lead to downloader and backdoor FlawedAmmyy, mostly to target users in South Korea. We also touch on the latest TA505 developments, including an email stealer, their use of legitimate software and MSI Installer, and more. The post Shifting Tactics: […]
June’s Patch Tuesday Fixes 88 Security Flaws, Including SandboxEscaper’s Zero Days, HoloLens June 12, 2019
Microsoft’s June Patch Tuesday announced the release of 88 vulnerability patches in this month’s security bulletin, as well as four advisories and one servicing stack update. Four of the critical patches included in the release are fixes for the zero-days SandboxEscaper previously disclosed. The post June’s Patch Tuesday Fixes 88 Security Flaws, Including SandboxEscaper’s Zero […]
MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools June 10, 2019
We found new campaigns that appear to wear the badge of MuddyWater. Analysis of these campaigns revealed the use of new tools and payloads, which indicates that the well-known threat actor group is continuously developing their schemes. We also unearthed and detailed our other findings on MuddyWater, such as its connection to four Android malware […]
CVE-2019-2725 Exploited and Certificate Files Used for Obfuscation to Deliver Monero Miner June 10, 2019
We found cryptocurrency-mining activity that involves the exploitation of the Oracle WebLogic server vulnerability CVE-2019-2725 with the interesting behavior of using certificate files as an obfuscation tactic. The post CVE-2019-2725 Exploited and Certificate Files Used for Obfuscation to Deliver Monero Miner appeared first on .
Monero-Mining Malware PCASTLE Zeroes Back In on China, Now Uses Multilayered Fileless Arrival Techniques June 5, 2019
Abusing PowerShell to deliver malware isn’t new; it's actually a prevalent technique that many fileless threats use. We regularly encounter these kinds of threats, and Trend Micro behavior monitoring technology proactively detects and blocks them. We have smart patterns, for instance, that actively detect scheduled tasks created by malicious PowerShell scripts. We also have network […]
BlackSquid Slithers Into Servers and Drives With 8 Notorious Exploits to Drop XMRig Miner June 3, 2019
We found a new wormable malware we've named BlackSquid targeting web servers, network and removable drives using evasion, anti-virtualization, anti-debugging, and anti-sandboxing techniques to drop a Monero miner. The post BlackSquid Slithers Into Servers and Drives With 8 Notorious Exploits to Drop XMRig Miner appeared first on .
Infected Cryptocurrency-Mining Containers Target Docker Hosts With Exposed APIs, Use Shodan to Find Additional Victims May 30, 2019
We discovered a Docker Hub repository that has been sending infected cryptocurrency-mining containers to hubs with publicly exposed APIs. Some of the images within the repository contained a Shodan script that identified potential targets for further distribution. The post Infected Cryptocurrency-Mining Containers Target Docker Hosts With Exposed APIs, Use Shodan to Find Additional Victims appeared […]

You might also likeclose

Tuesday, 14/10/2014 10:45 PM
zero-day vulnerability - Sandworm -CVE-2014-4114
Tuesday, 04/12/2012 2:40 PM
Scam Targeted at Permanent TSB Customers