Linux Shishiga malware using LUA scripts
2017-04-27
Among all the Linux samples that we receive every day, we noticed one sample detected only by Dr.Web – their detection name was Linux.LuaBot. We deemed this to be suspiciousRead More →
NSA backdoor detected on >55,000 Windows boxes can now be remotely removed
2017-04-26
Microsoft dismisses DoublePulsar infection estimates, but otherwise remains silent. After Microsoft officials dismissed evidence that more than 10,000 Windows machines on the Internet were infected by a highly advanced National SecurityRead More →
Webroot antivirus mistakenly flags Windows as malware
2017-04-25
Windows’ system files were flagged as malicious, and Facebook was marked as a phishing site. A malware signature update issued by the company on Monday triggered the software into mistakenlyRead More →
Point-of-Sale Malware Steals Driver’s License Information
2017-04-25
Malware specialized in infecting Point of Sale (PoS) software has gained the ability to search and steal driver’s license information, according to a report published by US cyber-security firm TrendRead More →
Ransomware hidden inside a Word document that’s hidden inside a PDF
2017-04-25
SophosLabs has discovered a new spam campaign where ransomware is downloaded and run by a macro hidden inside a Word document that is in turn nested within a PDF, like a Russian matryoshkaRead More →
Interpol Identifies 8,800 C&C Servers Used for Malware, Ransomware, Others
2017-04-25
Interpol investigators announced today they’d identified over 8,800 servers hosted across eight countries in Southeast Asia used for various cybercrime operations. According to Interpol, these are command-and-control (C&C) servers usedRead More →
Fake app hiding a SMSVova spyware went undetected for years in the Google Play Stores
2017-04-24
Millions of users looking to get software updates have downloaded an app hiding a spyware called SMSVova through the official Google Play store. Bad news for millions of Android usersRead More →
DoublePulsar Initial SMB Backdoor Ring 0 Shellcode Analysis
2017-04-22
One week ago today, the Shadow Brokers (an unknown hacking entity) leaked the Equation Group’s (NSA) FuzzBunch software, an exploitation framework similar to Metasploit. In the framework were several unauthenticated,Read More →
The Locky Ransomware is Back and Still Adding OSIRIS to Encrypted Files
2017-04-22
After almost an almost non-existent presence in 2017 and a few weeks off, Locky is back with a fresh wave of SPAM emails containing malicious docs. While it is not knownRead More →
10,000 Windows computers may be infected by advanced NSA backdoor
2017-04-22
Did script kiddies use DoublePulsar code released by NSA-leaking Shadow Brokers? Security experts believe that tens of thousands of Windows computers may have been infected by a highly advanced NationalRead More →
