A backdoor also known as: Trojan.PWS.OnlineGames.AAGG Trojan.Magania.19302 Trojan.PWS.OnlineGames.AAGG TSPY_ONLINEG.IGO Win32.Trojan.WisdomEyes.16070401.9500.9932 Infostealer.Onlinegame Win32/Frethog.CIL TSPY_ONLINEG.IGO Win.Spyware.59235-2 Trojan-GameThief.Win32.OnLineGames.txbo Trojan.PWS.OnlineGames.AAGG Trojan.Win32.OnLineGames.lhee Troj.PSW32.W.QQPass.lpXN Trojan.PWS.OnlineGames.AAGG TrojWare.Win32.Trojan.Inject.~II Trojan.PWS.OnlineGames.AAGG Trojan.MulDrop4.15206 PWS-OnlineGames.co Trojan/PSW.OnLineGames.auru Trojan[GameThief]/Win32.WOW.gic Win32.Troj.OnlineGames.sd.kcloud Trojan.PWS.OnlineGames.AAGG Trojan.Win32.PSWIGames.11924.B Trojan.PWS.OnlineGames.AAGG Trojan/Win32.OnlineGameHack.C909 TrojanPSW.OnLineGames.nr Trojan-Spy.OnLineGames


Cyphort has been monitoring how threat actors are exploiting computing resources from compromised victims to mine various crypto currencies.


A backdoor also known as: Trojan-Ransom.Win32.Toxic.a BehavesLike.Win32.BadFile.jc Trojan.Win32.Ransom.a


A backdoor also known as: TrojanRansom.Blocker Ransom_Blocker.R0C1C0DHU17 Win32.Trojan.WisdomEyes.16070401.9500.9605 Ransom_Blocker.R0C1C0DHU17 Trojan-Ransom.Win32.Blocker.kgrm Troj.Ransom.W32.Blocker!c BehavesLike.Win32.RansomCerber.gh W32/Trojan.DOGS-7123 W32.Trojan.Backdoor TR/Crypt.ZPACK.hmkaa Trojan-Ransom.Win32.Blocker.kgrm Trojan/Win32.Dapato.C1720332 Hoax.Blocker Trojan.Dropper Trj/CI.A Win32.Trojan.Blocker.Akzg Trojan.Blocker!U13z+V78Arg Win32/Trojan.Ransom.acc


Since the start of the Russo-Ukrainian conflict, Kaspersky researchers and the international community at large have identified a significant number of cyberattacks executed in a political and geopolitical context.


A backdoor also known as: Win.Trojan.Dadobra-446 Trojan-Downloader.Win32.Banload.bnlx Trojan.Win32.Downloader.337408.M TrojWare.Win32.TrojanDownloader.Dadobra.~JK Trojan.DownLoader5.10443 Trojan-Downloader.Win32.Banload TrojanDownloader.Banload.bhs Trojan[Downloader]/Win32.Banload Trojan-Downloader.Win32.Banload.bnlx Trojan:Win32/Banload.A Downloader/Win32.Banload.C108589 Win32/Spy.Banker.WNS Win32.Trojan-downloader.Banload.Ebhk


Let's examine a couple of interesting delivery techniques from an APT active for the past several years, the Spring Dragon APT.


SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010.


A backdoor also known as: TSPY_MALUMPOS.SM TSPY_MALUMPOS.SM Win.Trojan.MalumPOS-1 TR/AD.Siaacsia.ielmw Trojan:Win32/Malumpos.A Trojan/Win32.Malumpos.C1727078 Trojan-Spy.MalumPOS Win32/Trojan.Spy.958


An aside: the rootkit does appear to be named after the Pokémon of the same name.


A backdoor also known as: Application.Hacktool.EH Trojan/W32.HackTool.215552 Trojan.Mauvaise.SL1 Win.Tool.Wincred-6333920-0 Application.Hacktool.EH HackTool.Win64.WinCred.c Application.Hacktool.EH Application.Hacktool.EH Tool.WinCred.1 BehavesLike.Win64.BrowseFox.dh W64/Application.WFWG-6345 Application.Hacktool.EH HackTool.Win64.WinCred.c Application.Hacktool.EH HackTool.Win64 Trj/CI.A


A backdoor also known as: Trojan-Dropper/W32.Dapato.26112 Trojan-Dropper.Win32.Dapato!O BackdoorAPT.Hikiti.G4 Win32.Trojan.WisdomEyes.16070401.9500.9983 Backdoor.Trojan BKDR_FEXEL.MM Backdoor.Win32.Fexel.b Trojan.Win32.Dapato.ceuzkz Trojan.DownLoader10.12491 BehavesLike.Win32.Downloader.mc Trojan.Win32.Farfli W32/Backdoor.QCOF-8324 Trojan[Dropper]/Win32.Dapato Trojan.Heur.E97E22 Troj.Dropper.W32.Dapato.dawi!c Backdoor.Win32.Fexel.b Backdoor:Win32/Hikiti.G!dha Dropper/Win32.Dapato.C199271 Win32.Backdoor.Fexel.Wvkt Trj/CI.A


It is assumed that actors using the malware are targeting small- to medium-sized businesses given the malware's focus on VNC applications.


In spite of these commonalities, we have not identified any firm links between the two groups.


This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.


“ The takeaway ? Internet users should keep on securing their activities with good security solutions for both computers and mobile devices. ” Hashes : E5212D4416486AF42E7ED1F58A526AEF77BE89BE A9891222232145581FE8D0D483EDB4B18836BCFC AFF9F39A6CA5D68C599B30012D79DA29E2672C6E Insidious Android malware gives up all malicious features but one to gain stealth ESET researchers detect a new way of misusing Accessibility Service , the Achilles ’ heel of Android security 22 May 2020 - 03:00PM ESET researchers have analyzed an extremely dangerous Android app that can perform a host of nefarious actions , notably wiping out the victim ’ s bank account or cryptocurrency wallet and taking over their email or social media accounts .


A backdoor also known as: Trojan.ArchSMS!Tf0HkXJW05g Hoax.Win32.ArchSMS.hqqg Hoax.ArchSMS.hqqg SecurityRisk.PremiumSMSScam Hoax.Win32.ArchSMS Trj/CI.A


The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used.


A backdoor also known as: Backdoor.Win32.Koutodoor!IK Backdoor:Win32/Koutodoor.B Backdoor.Win32.Koutodoor.da SHeur2.AIKX


The StreamEx family has the ability to access and modify the user's file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands.


A backdoor also known as: Trojan.Comfold Trojan:Win32/Comfold.A


Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b com.dhp.ozqh Facebook 5022495104c280286e65184e3164f3f248356d065ad76acef48ee2ce244ffdc8 ufD.wyjyx.vahvh Anshin Scan a0f3df39d20c4eaa410a61a527507dbc6b17c7f974f76e13181e98225bda0511 com.aqyh.xolo 佐川急便 cb412b9a26c1e51ece7a0e6f98f085e1c27aa0251172bf0a361eb5d1165307f7 jp.co.sagawa.SagawaOfficialApp 佐川急便 Malicious URLs : hxxp : //38 [ .


A backdoor also known as: Worm.Win32.AutoRun!O Worm.AutoRun.Win32.132231 Win32.Trojan.ServStart.a Win.Trojan.Qhost-160 Trojan.Win32.AutoRun.cvpwhj Trojan.DownLoader4.40333 BehavesLike.Win32.Ipamor.lm TR/Dldr.JKCN Trojan/Win32.Downloader.C40577 Trojan.Win32.Wc Win32/AutoRun.PT Trojan-Proxy.Win32.Ranky


The handful of malicious features densely packed in this new malware also includes the ability to drop other malware.


A backdoor also known as: W32.FamVT.ShipBHQc.Trojan Trojan.Win32.ShipUp!O TrojanPWS.Zbot.Y Trojan/Kryptik.awzk Trojan.Razy.D3C5B TROJ_KRYPTK.SML3 Win.Trojan.Redirect-6055402-0 Trojan.Win32.ShipUp.brmnrc Trojan.Redirect.140 Trojan.ShipUp.Win32.1152 TROJ_KRYPTK.SML3 BehavesLike.Win32.PWSZbot.dh Trojan.Win32.ShipUp Trojan/ShipUp.ix TR/Rogue.kdz.11287.3 Trojan/Win32.ShipUp TrojanDropper:Win32/Gepys.A Troj.W32.ShipUp.lINm Trojan/Win32.Shipup.R58491 TScope.Malware-Cryptor.SB Trojan.FakeMS.ED W32/Kryptik.AYTK!tr


A backdoor also known as: Trojan-Spy.Win32.Tibia!O Win32.Trojan.WisdomEyes.16070401.9500.9963 Trojan.Win32.Drop.cbndjf Trojan.MulDrop3.1226 BehavesLike.Win32.BadFile.rc Trojan-Dropper.Win32.Monya TR/Drop.Tibdef.B Trojan.Raldhep.1 TrojanDropper:Win32/Tibdef.B W32/Dropper.AAAI!tr


It is in use by the Molerats aka Gaza cybergang, a politically motivated group whose main objective, we believe, is intelligence gathering.


The Magnitude exploit kit has been using an XML configuration file critical to retrieving the malware payload Cerber for several months already.


Here is Forcepoint Security Labs we have seen a number of changes and improvements over the last few months.


The actors compromised the sites of a local television network, educational organizations, a religious institute, and a known political party in Taiwan; and a popular news site in Hong Kong.


List of package names of apps on events from which the Trojan opens a fake Google Play window ( for the Russian version of the Trojan ) Example of Trojan screen overlapping other apps When bank card details are entered in the fake window , Riltok performs basic validation checks : card validity period , number checksum , CVC length , whether the number is in the denylist sewn into the Trojan code : Examples of phishing pages imitating mobile banks At the time of writing , the functionality of most of the Western versions of Riltok was somewhat pared down compared to the Russian one .


A backdoor also known as: W32.Vetor.PE Virus.Win32.Virut.1!O W32.Virut.G PE_VIRUX.O W32/Trojan2.OALA W32.Virut.CF Win32/Virut.17408 PE_VIRUX.O Win32.Virus.Virut.Q Virus.Win32.Virut.ce Virus.Win32.Virut.hpeg Virus.Win32.Virut.CE Win32.Virut.56 Virus.Virut.Win32.1938 BehavesLike.Win32.Virut.cc W32/Trojan.JXET-3602 Win32/Virut.bt Virus/Win32.Virut.ce Win32.Virut.cr.61440 W32.Virut.lM6H Virus.Win32.Virut.ce TrojanClicker:MSIL/Xobnff.A Win32/Virut.F Virus.Virut.14 W32/Sality.AO Win32/Virut.NBP Virus.Win32.Virut W32/Virut.CE Virus.Win32.Virut.M


A backdoor also known as: Backdoor.Zegost.FC.2167 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.DownLoader22.48526 BehavesLike.Win32.Trojan.cc Trojan.MSIL.Bladabindi.1 MSIL/Injector.PJG!tr Trj/GdSda.A


Sinkhole data explained below shows just how quickly this campaign is impacting victims.


A backdoor also known as: Trojan.Netstop.A Trojan.Netstop.A Backdoor.Trojan Win32/Noshare.N TROJ_NETSTOPA.A Trojan.Netstop.A Trojan.Win32.Netstop.dyylkw Win32.Trojan-spy.Gc.Hsii Trojan.Netstop.A Worm.Win32.SpyBot.GC Trojan.Netstop.A Email-Worm.Win32.GOPworm.196 TROJ_NETSTOPA.A TR/Netstop.A Trojan.Netstop.A Trojan.Netstop.A Email-Worm.Win32.GOPworm.196 Win32/SpyBot.GC Worm.SpyBot!FiFtixQJKm8 W32/Netstop.A!tr Bck/Secur.A


FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.


In recent years, the detention and interrogation of members of online communities has been publicized by state media for propaganda purposes.


PaloAlto Unit 42 researchers have observed a new Remote Access Tool RAT constructed by an unknown actor of Italian origin.


A backdoor also known as: Trojan.Inject.IA Trojan.Skeeyah.8818 Infostealer.Kegotip!gm TSPY_KEGOTIP.SMA Trojan.Inject.IA Trojan-PSW.Win32.Minari.a Trojan.Inject.IA Trojan.Inject.IA Trojan.Inject.IA Trojan.PWS.Stealer.2518 TSPY_KEGOTIP.SMA BehavesLike.Win32.Backdoor.ch Trojan[PSW]/Win32.Minari Trojan.Inject.IA Trojan-PSW.Win32.Minari.a Trojan/Win32.PWS.R100577 Trojan.Inject.IA


A backdoor also known as: Backdoor.Win32.Mutopy!O Trojan.Mutopy.A TROJ_MUTOPY.SMYN Win32.Trojan.WisdomEyes.16070401.9500.9995 TROJ_MUTOPY.SMYN Win.Trojan.Multi-6413508-0 Troj.Dropper.W32.Dapato.lCcB Trojan.MulDrop4.10927 BehavesLike.Win32.Downloader.hh TR/Kazy.34213.jh Trojan:Win32/Mutopy.A Trojan.Naffy.1 Trojan/Win32.HDC.C53646 TScope.Malware-Cryptor.SB Trojan.Win32.Jorik W32/Rodecap.AS!tr


A backdoor also known as: Backdoor.W32.Androm.toYX Trojan/Injector.drgl Win32.Trojan.WisdomEyes.16070401.9500.9978 Win.Trojan.WillExec-6356235-0 Backdoor.Androm.sdz Trojan.Zusy.D3FE2C Trojan:Win32/Lethic.Q!bit Backdoor.Androm Trj/GdSda.A W32/Injector.DQID!tr


Samples uploaded to public repositories indicate that the new version of Typhon Reborn has been in the wild since December 2022.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.RHUU-4415 MSIL.Trojan.Packed.G Trojan-Dropper.Win32.Scrop.ccm Trojan.Win32.Inject.dzszva Trojan.PWS.Multi.1690 BehavesLike.Win32.Trojan.tc TrojanDropper.Sysn.arw TR/Injector.drydq Trojan/MSIL.Inject Trojan:MSIL/Plimrost.B Trojan.Kazy.DAD984 Trojan-Dropper.Win32.Scrop.ccm Trojan/Win32.Injector.C952834 Trj/CI.A Trojan.MSIL.Injector MSIL/Kryptik.DDP!tr


Zcrypt uses the Nullsoft Scriptable Install System, which works like a Zip file, decompressing and loading the content while running.


The malware used in the new attacks was a variant of the infamous Shamoon worm that targeted Saudi Aramco and Rasgas back in 2012.


This technical note discusses a relatively undocumented implant used by the APT10 group.


A backdoor also known as: TROJ_STARTPA.NSS W32/Backdoor2.HTGN Win32/Wysotot.GJVbdHD TROJ_STARTPA.NSS Win32.Trojan-Hijacker.Wysotot.A Trojan.Win32.AdLoad.eizvbn Adware.Mutabaha.255 Adware.MutabahaCRTD.Win32.1189 BehavesLike.Win32.ICLoader.gc Backdoor.Win32.ZAccess W32/Backdoor.SAIZ-5729 Trojan/Win32.StartPage Trojan.Adware.Zusy.D1584D PUP.Elex/Variant Downloader/Win32.Adware.R86759 Trojan.StartPage PUP.Optional.Elex Trj/CI.A Trojan.StartPage!B6aZ1c5P97Y


A backdoor also known as: Trojan.MSIL.Crypt.gauf Trojan.Starter.7472 Trojan.MSIL.ilny TR/AD.Binderon.roatv Trojan.Ursu.D13D6D Trojan.MSIL.Crypt.gauf PWS:AutoIt/Passup.A Win32/Spy.Autoit.BY Trj/GdSda.A


A backdoor also known as: HW32.Packed.1BC9 Trojan.Banavkill Trojan-Banker.Win32.Banbra.wjem Trojan.Win32.Banbra.exnyzm TR/Spy.Banker.ohxzm Trojan.Ursu.D10A45 Trojan-Banker.Win32.Banbra.wjem Trojan:Win32/Banavkill.A Trojan/Win32.Banbra.C2352559 Trojan-Banker.Banbra Trj/GdSda.A Win32.Trojan.Falsesign.Htma Win32/Trojan.f8b


We are providing a detailed analysis of the rootkit, and also making the samples available to the industry to help others block this threat.


A backdoor also known as: W32.OnGamesLT180912HKGHAAI.Trojan Trojan.PWS.OnlineGames.ZON Trojan.PWS.OnlineGames.ZON Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Gampass TSPY_ONLINEG.FGF Win.Trojan.Onlinegames-44 Trojan.PWS.OnlineGames.ZON Trojan.PWS.OnlineGames.ZON Trojan.Win32.OnLineGames.rzwt Troj.PSW32.W.OnLineGames.aoem!c Trojan.PWS.OnlineGames.ZON Packed.Win32.MUPACK.~KW Trojan.PWS.OnlineGames.ZON Trojan.PWS.Wsgame.5652 Trojan.OnLineGames.Win32.160328 TSPY_ONLINEG.FGF BehavesLike.Win32.Sdbot.cz Trojan/PSW.OnLineGames.akkc TrojanDropper:Win32/Tilcun.E Trojan/Win32.MalPack.C60090 Trojan.PWS.OnlineGames.ZON BScope.Trojan-PSW.Gomex.22 Trj/Pupack.A


The infamous Remote Access Trojan RAT Poison Ivy hereafter referred to as PIVY has resurfaced recently, and exhibits some new behaviors.


However, we recently encountered a botnet that uses a more unusual method: an FTP server that, in effect, acts as a C C server.


A backdoor also known as: Backdoor/W32.Small.40960.BX TROJ_FAKEAV.ASI W32/Backdoor2.HASV Backdoor.Trojan.B Win32/Wonip.A TROJ_FAKEAV.ASI Trojan.PWS.Sniftp.15 W32/Backdoor.YSEB-6778 BDS/Wonip.A Backdoor:Win32/Wonip.A Trojan/Win32.Xema.C82592 W32/Backdr.FB!tr Win32/Backdoor.435


Since we published our article on Sage 2.0 last February, and the discovery of version 2.2 in March, the FortiGuard Labs team hasn't seen significant activity with this malware for over six months.


A backdoor also known as: Trojan.Qhosts Trojan.Win32.Z.Redcap.1251647 TR/RedCap.ymgda


We identified one specific spear phishing campaign launched against targets within Palestine, and specifically against Palestinian law enforcement agencies.


Once installed on a device FrozenCell is capable of : Recording calls Retrieving generic phone metadata ( e.g. , cell location , mobile country code , mobile network code ) Geolocating a device Extracting SMS messages Retrieving a victim 's accounts Exfiltrating images Downloading and installing additional applications Searching for and exfiltrating pdf , doc , docx , ppt , pptx , xls , and xlsx file types Retrieving contacts The graph below represents a split of the types of data from only one misconfigured command and control server ( out of over 37 servers ) .


A backdoor also known as: Backdoor.Yurist.Win32.37 Win32.Trojan.WisdomEyes.16070401.9500.9992 Backdoor.Win32.Yurist.cy Trojan.Win32.XFlash.bodumo Backdoor.W32.Yurist.cp!c Heur.Packed.Unknown BackDoor.XFlash BehavesLike.Win32.Backdoor.ph Backdoor/Yurist.z BDS/Yurist.K Backdoor:Win32/Yurist.K Trojan.Graftor.D45274 Backdoor.Win32.Yurist.cy Trojan/Win32.LdPinch.C27294 Win32.Backdoor.Yurist.Eads Backdoor.Yurist!9F5bediy4gg Backdoor.Win32.Yurist Trj/CI.A Win32/Backdoor.c62


If the victim opens it up, it will not only infect their system but send the same phishing document to other contacts via their Outlook inbox.


A backdoor also known as: BKDR_BAYROB.SM4 Win32.Trojan.WisdomEyes.16070401.9500.9948 BKDR_BAYROB.SM4 TrojWare.Win32.Bayrob.A Trojan.Kelios.1 Trojan:Win32/Horkremoz.A W32/Bayrob.O!tr Win32/Trojan.4af


A backdoor also known as: Backdoor.Win32.TDSS!O Backdoor.TDSS.Win32.7367 Trojan/Olmarik.akn Trojan.TDss.58 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_ALUREON_CD102969.RDXN Win.Trojan.Tdss-302 Backdoor.Win32.TDSS.dtx Trojan.Win32.TDSS.cdwoi Backdoor.Win32.A.Tdss.63488.B TrojWare.Win32.Olmarik.AME Trojan.DownLoader1.46896 TSPY_ALUREON_CD102969.RDXN BehavesLike.Win32.VBObfus.kh Backdoor.Win32.TDSS Backdoor/TDSS.apn Trojan[Backdoor]/Win32.TDSS Win32.Hack.TDSS.d.kcloud Backdoor.Win32.TDSS.dtx Trojan/Win32.Tdss.R1603 DNSChanger.ca Trojan.FakeAlert Win32/Olmarik.AKN Backdoor.TDSS!fzuavqQuzWg W32/DNSChanger.CA!tr


This, combined with its focus on a specific region, makes this threat interesting from the malware researchers' perspective.


Once they obtained access to the server, the attackers infected the system with two malicious payloads.


A typical Lurk infection uses browser exploits to deliver non-persistent payloads to potential victims, probing their targets before deploying additional malware.


Some of the popular Android applications that Ewind targets include GTA Vice City, AVG cleaner, Minecraft – Pocket Edition, Avast! Ransomware Removal, VKontakte, and Opera Mobile.


A backdoor also known as: Trojan.Strictor.D1F9FA Trojan.Win32.BuhTrap.c Trojan.YakesCRTD.Win32.4839 Trojan/Win32.BuhTrap.c Backdoor:Win32/Buhtrap.A!dha Trojan.Win32.BuhTrap.c Trj/GdSda.A Backdoor.Win32.Buhtrap W32/Delf.QJL!tr Win32/Trojan.5c7


A backdoor also known as: W32/Etap.d Win32.Trojan.WisdomEyes.16070401.9500.9826 Trojan.GootKit!gm BehavesLike.Win32.Injector.fh Trojan.Barys.D1A48


That's why we refer to this malware as Shakti Trojan.


A backdoor also known as: Trojan/Klone.bz W32/MUPX.A Packed.Win32.Klone.bz BackDoor.IRC.Rxbot.69 Backdoor.Win32.Rbot!IK Win32.Hack.Klone.bz.kcloud Packed/Win32.Klone Backdoor.IRCbot!312D Backdoor.Win32.Rbot


Attackers also used the name of the top-ranking official associated with Minister of Home affairs in the signature of the email, this is to make it look like the email was sent by a high-ranking Government official associated with Ministry of Home Affairs MHA.


A backdoor also known as: Trojan.Crypt.GH Trojan.Crypt.GH Trojan.Crypt.GH Win32.Trojan.WisdomEyes.16070401.9500.9999 Infostealer.Gampass TROJ_PUKISH.A Trojan.Crypt.GH Win32.Trojan-dropper.Drob.Pdmj Trojan.Crypt.GH Trojan.Crypt.GH Trojan.MulDrop7.42417 TROJ_PUKISH.A Trojan-Dropper.Win32.Drob W32/Trojan.SPVB-8287 Win32.Infect.a.124448 TrojanDropper:Win32/Pukish.A Trojan.Crypt.GH Trj/CI.A Win32/Trojan.f42


A backdoor also known as: W32.W.CodeRed.l11t Exploit:Win32/CVE-2006-3942.A Exploit.Win32.CVE-2006-3942


A backdoor also known as: Troj.W32.Havex!c Win32.Trojan.WisdomEyes.16070401.9500.9950 Trojan.Win32.Havex.tm Trojan.Proxy2.1026 BehavesLike.Win32.Dropper.gh Trojan.Havex.w TR/Havex.fbdyv Trojan.Win32.Havex.tm


A backdoor also known as: Win32.Worm.P2P.Puce.G Worm/W32.Kapucen.106496.EK I-Worm.Kapucen.b.n4 W32/Kapucen.b Trojan.Win32.Kapucen.qyzel Win32/Puce.D WORM_KAPUCEN.B Worm.Puce.E P2P-Worm.Win32.Kapucen.b Win32.Worm.P2P.Puce.G Worm.Kapucen.A Worm.Win32.P2P-Kapucen.106496.C Worm.Win32.Kapucen.B Win32.Worm.P2P.Puce.G Win32.HLLW.Puce Worm/Puce.D.90 WORM_KAPUCEN.B Worm/P2P.Kapcen.b Worm:Win32/Puce.D Win32.Worm.P2P.Puce.G Worm/Win32.Kapucen Trojan.Win32.Kapucen.B Win32/Kapucen.B P2P-Worm.Win32.Kapucen.b W32/Kapucen.fam!worm.p2p Win32/Puce.C W32/Puce.E.worm


On July 17, 2017, we detected a malicious document in VirusTotal exploiting CVE-2017-0199.


A backdoor also known as: Packed.Win32.Klone!O Backdoor.SkSocket Backdoor.Trojan Trojan.Win32.SkSocket.uwlqa Backdoor.Win32.SkSocket.109_t0 BackDoor.Sksock Virus.Win32.SkSocket.C Backdoor/SkSocket.o BDS/SkSocket.109 Win-Trojan/SkSocket.40960 Trj/CI.A Win32/SkSocket.109 Win32.Backdoor.Sksocket.Dyqp Trojan/Win32.lssj.2cc.rgrk


Initial indicators of compromise from todays WannaCry ransomware outbreak.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9971 Win.Spyware.1756-2 BehavesLike.Win32.Autorun.dc Trojan/Win32.Xema.C73573


A backdoor also known as: W32.Clod62e.Trojan.18e2 Win32.Trojan.WisdomEyes.16070401.9500.9922 Trojan.Kasperbogi W32/Trojan.PRNK-2932 TR/Golroted.jumln Trojan.Strictor.D16D8E Trojan:Win32/Parsky.A!bit Trj/GdSda.A Win32/Trojan.cfd


A recent investigation by security firm CTI has identified a new wave of malware delivered to the MaaS and PPI service providers in the underground black markets, including a controversial piece of code linked to North-Korean hackers.


The payload, distributed disguised as antivirus, is a variant of Korplug RAT aka PlugX – a spyware with former associations with Chinese APT groups, and known from targeted attacks at important institutions of various countries.


A backdoor also known as: PUP.Optional.FilePile.A PE:PUF.FilePile!1.9E19


The site was redirecting visitors to the malware through a compromised OpenX Ad server injecting a malicious iframe into the page.


A backdoor also known as: Win32.Trojan.Ad.Pdms Trojan.InstallCube.412 Variant.Kazy.apq TR/AD.Fakruce.M.2 Trojan.Kazy.DBFFE0 Trojan.Win32.Z.Kazy.2435953 Trojan:Win32/Fakruce.B Trojan.Kazy!YZdrjH6xcT8 Trj/CI.A Win32/Trojan.824


Shamoon W32.Disttrack first made headlines in 2012 when it was used in attacks against energy companies in Saudi Arabia.


A backdoor also known as: Win32.Rootkit.Koutodoor.a TrojWare.Win32.Zybr.A W32.Trojan.Koutodoor.E Trojan:Win32/Koutodoor.F Trojan.Zusy.D41F3C Trojan.Win32.koutodoor.i Trojan.Rootkit RootKit.Win32.Koutodoor.I


A backdoor also known as: Backdoor.NSIS Win32.Trojan.WisdomEyes.16070401.9500.9623 TR/AD.Trochilus.illau Backdoor:Win32/Trochil.A.dll!dha Win32/Korplug.KA Win32/Trojan.d66


From troubleshooting machines across countries to observing employees across rooms, RAT solutions have become widely used tools for remote maintenance and monitoring.


A backdoor also known as: Trojan/W32.AntiAV.1355776.B Trojan.Win32.Vilsel!O Worm.Pykspa.C3 Worm.SkypeBot Trojan.Pykspa.1 Win32.Worm.Autorun.o W32.Pykspa.D Win32/Vilsel.CE WORM_VILSEL.SMC Win.Worm.Pykspa-1 Trojan-Ransom.Win32.Blocker.jcen Backdoor.W32.Zepfod.lohV Worm.Win32.Pykspa.a WORM_VILSEL.SMC BehavesLike.Win32.Pykse.tz Trojan/Blocker.lhz Trojan/Win32.AntiAV Trojan-Ransom.Win32.Blocker.jcen Trojan/Win32.Zepfod.R4378 Trojan.ChidikSun.28205 Trojan.Pykspa Trojan.Win32.Spy Trj/Vilsel.B Worm.Win32.Pykse.A


Mobile malware's disruptive impact on enterprises continues to see an uptick in prevalence as mobile devices become an increasingly preferred platform to flexibly access and manage data.


Morphick responded to a Kronos phishing campaign that involved a document with a malicious macro that downloaded the Kronos banking malware.


A backdoor also known as: Trojan.Graftor.D13264 Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.DownLoad3.euzkrf Trojan.Win32.Z.Graftor.605184.A Trojan.DownLoad3.23753 BehavesLike.Win32.Trojan.hh Trojan.Win32.CoinMiner Trojan/Win32.Unknown Trojan:Win32/Herxmin.A Trojan.CoinMiner!kUww8sDe3p0 W32/CoinMiner.CE!tr


The overall motivation of this campaign is unclear at this time.


In fact, they have been using them since at least 2014 with very few variations in their modus operandi.


A backdoor also known as: W32.Info_InstallNA128.Trojan Trojan/W32.Buzus.61952.BP Trojan.Bulta Win32.Trojan.WisdomEyes.16070401.9500.9891 W32/MalwareS.FWD Win32/Tnega.AUFK Trojan.Win32.Drop.cuupf Trojan.Win32.Buzus.61952.D Trojan.Inject.63252 Trojan.Buzus.Win32.27194 BehavesLike.Win32.Backdoor.kh W32/Risk.CHGA-0655 Trojan/Buzus.svw Trojan/Win32.Buzus Backdoor:Win32/Gaertob.A Troj.W32.Buzus.tnoM Trojan/Win32.Buzus.R42500 BScope.Trojan.Palevo.012 Trojan.Buzus Trojan.Buzus!iqgr48px8nU Virus.Win32.Injector W32/Injector.fam!tr Win32/Trojan.203


A backdoor also known as: W32.FadobesLTA.Trojan Trojan.Nixofro.A3 Trojan/Downloader.VB.qjf W32/Backdoor.VMXK-0114 Win32/TrojanDownloader.VB.QJF TROJ_SPNR.35CD14 Trojan.Win32.Foreign.ctjhyf Trojan.Win32.Z.Foreign.1078272.B[h] Troj.Ransom.W32.Foreign.kcme!c Trojan:W32/Kilim.P Trojan.Guncelle.2 Trojan.Foreign.Win32.41642 TROJ_SPNR.35CD14 BehavesLike.Win32.Trojan.tm W32/Backdoor2.HUDC TR/Kazy.323825.8 W32/Foreign.KCME!tr Trojan[Ransom]/Win32.Foreign Win32.Troj.Undef.kcloud Trojan.Symmi.D97A6 Trojan:Win32/Nixofro.A Hoax.Foreign Win32.Trojan.Foreign.Htmh Trojan.Win32.Nixofro


This was developed as an alternative to [Telnet]https://null-byte.wonderhowto.com/how-to/hack-like-pro-use-netcat-swiss-army-knife-hacking-tools-0148657/, which sends information in plaintext, which is clearly a problem, especially when [passwords]https://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-passwords-part-1-principles-technologies-0156136/ are involved.


A backdoor also known as: Trojan.Tiny.S22205 Win32.Trojan.WisdomEyes.16070401.9500.9981 TrojanDownloader.TinyLoader.c TR/Crypt.Xpack.xhbzp Trojan:Win32/Anobato.A


root9B discovered an advanced, targeted PoS intrusion focused on harvesting payment card information for exfiltration.


A backdoor also known as: W32.HfsAutoB.FD30 Backdoor.Win32.Delf!O Backdoor.Delf.Win32.7383 Win32.Worm.Delf.cq W32.Minudazash Win.Trojan.Delf-10643 Backdoor.Win32.Delf.oqi Trojan.Win32.Delf.culgk Backdoor.Win32.Delf.308224.E Win32.HLLW.Autoruner1.11184 BehavesLike.Win32.Fake.fc Virus.Win32.Virut Backdoor/Delf.ode Trojan[Backdoor]/Win32.Delf Worm:Win32/Scafros.A Backdoor.Win32.Delf.oqi Win32/FakeMS.WOCR Backdoor.Delf W32/Banker.LWD Backdoor.Delf!0+it/723aCk W32/Delf.OQI!tr.bdr


A backdoor also known as: Trojan.Dukescamlock Trojan.TechSupportScam Ransom_DukescamLock.R002C0TK817 Win32.Trojan.WisdomEyes.16070401.9500.9553 W32.Golroted Ransom_DukescamLock.R002C0TK817 Trojan-FakeAV.MSIL.FakeSupport.d Trojan.KillProc.49845 Ransom.MSIL.DukescamLock TR/FakeSupport.gixtd Ransom:MSIL/DukescamLock.A Trojan-FakeAV.MSIL.FakeSupport.d Trj/GdSda.A MSIL/FakeSupport.AZ!tr


ESET researchers have discovered a new sneaky malware threat named Joao, targeting gamers worldwide.


CryptoWall is one ransomware variant that has shown gradual evolution over the past year with CryptoWall 2 and Cryptowall 3.


Yesterday January 19th we discovered a new wave of these attacks, where a number of electricity distribution companies in Ukraine were targeted again following the power outages in December.


Case in point: the emergence of UIWIX ransomware detected by Trend Micro as RANSOM_UIWIX.A and one notable Trojan our sensors detected.


A backdoor also known as: W32.eHeur.Virus02 Trojan.Patched.JJ Trojan.Patched.JJ Trojan.Patched.JJ Win32.Trojan.WisdomEyes.16070401.9500.9925 Backdoor.Graybird Trojan.Patched.JJ Trojan.Patched.JJ Trojan.Patched.JJ BehavesLike.Win32.BadFile.gh W32.Trojan.Patched Trojan:Win32/Jaku.C!dha Trojan.Patched.JJ Trojan.Win32.Jaku


In at least one case, an app used for jailbreaking was available via this third-party app store.


FBI and CISA believe this variant, which uses its own custom-made file encryption program, evolved from earlier iterations that used Zeon as a loader.


A backdoor also known as: Trojan/W32.AntiAV.105984 Trojan.Win32.AntiAV!O Trojan.FakeMS.ED Win32.Trojan.ImPatch.a Trojan.KillAV Win32/Gosht.AY Trojan.Win32.PcClient.zvjt Trojan.Win32.AntiAV.105984.B TrojWare.Win32.Magania.~AAD BehavesLike.Win32.Backdoor.ch Trojan/AntiAV.acg Trojan/Win32.AntiAV Trojan:Win32/Scelp.A Trojan/Win32.OnlineGameHack.R1939 Trojan.AntiAV Trj/Redbind.C Backdoor.Win32.Gh0st.g Trojan.AntiAV!x/J77uxYhp4 Backdoor.Win32.FirstInj W32/Farfli.DZ!tr


Linux.MulDrop.14 changes the password on the devices it infects, unpacks and launches a miner, and then, in an infinite loop, starts searching for network nodes with an open port 22.


Based on the type of targets, on Gaza being the source of the attacks, and on the type of information the attackers are after - we estimate with medium-high certainty that the Hamas terrorist organization is behind these attacks.


A backdoor also known as: W32.HfsAdware.C713 Adware.KraddareCRTD.Win32.3559 W32/Adware.AKQI HT_KRADDARE_FB150035.UVPM Win.Trojan.Kraddare-257 not-a-virus:Downloader.Win32.Snojan.dvv Trojan.Win32.Dwn.cwejxs Trojan.DownLoader21.62200 HT_KRADDARE_FB150035.UVPM W32/Adware.VBKZ-4259 Variant.Strictor.ij TrojanDownloader:Win32/Kraddare.D Trojan.Strictor.D13BAE not-a-virus:Downloader.Win32.Snojan.dvv Win32.Application.RaonMedia.A Downloader.Snojan Adware.Kraddare!CDLXoCIKpSY Trojan-Downloader.Win32.Kraddare


MITRE ATT & CK techniques Tactic ID Name Description Initial Access T1475 Deliver Malicious App via Authorized App Store The malware impersonates legitimate services on Google Play Persistence T1402 App Auto-Start at Device Boot An Android application can listen for the BOOT_COMPLETED broadcast , ensuring that the app 's functionality will be activated every time the device starts Impact T1472 Generate Fraudulent Advertising Revenue Generates revenue by automatically displaying ads The Rotexy mobile Trojan – banker and ransomware 22 NOV 2018 On the back of a surge in Trojan activity , we decided to carry out an in-depth analysis and track the evolution of some other popular malware families besides Asacub .


A backdoor also known as: Backdoor.Sanhotan Trojan/IRCBot.bh Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Tnega.CTXcdP TROJ_SANHOTAN.SMCC Trojan.Win32.Dwn.cwxrbq TrojWare.MSIL.IRCBot.bh Trojan.DownLoader10.23149 TROJ_SANHOTAN.SMCC Trojan.Msil BDS/MSIL.Sanhotan.A.3 Backdoor:MSIL/Sanhotan.A Trojan.Kazy.D3D12A Trojan/Win32.Strictor.C202516 Trojan.Badur Backdoor.MSIL!V0iyslQUBdw MSIL/IRCBot.AR!tr


Around 2014, a specific user group of BlackEnergy attackers came to our attention when they began deploying SCADA-related plugins to victims in the ICS and energy sectors around the world.


A backdoor also known as: Backdoor.Win32.PcClient!O Win32.Trojan.WisdomEyes.16070401.9500.9999 Hacktool.Rootkit Win.Trojan.PcClient-22 Backdoor.Win32.PcClient.qz Troj.W32.Pakes.l3y1 Backdoor.Win32.PcClient.~AB BackDoor.PcClient BackDoor-CKB.sys Backdoor.Win32.PcClient Backdoor/PcShare.uu BDS/Pcclient.hp.1.C Backdoor.Win32.PcClient.qz Trojan/Win32.PcClient.R32879 BackDoor-CKB.sys


A backdoor also known as: Trojan-PSW.Win32.Gip.112 Trojan.PWS.Gip.EJ GIP.Trojan Gip.1_12 Win32.PSW.Gip.112 TrojWare.Win32.PSW.Gip.112 Trojan.PWS.Gip.112 TR/PWStealer.Srv TROJ_GIP.112 Heuristic.BehavesLike.Win32.Downloader.A Win32/PSW.Gip.112 Trojan/PSW.Gip.112 Trojan-PWS.Win32.Gip!IK Backdoor.Win32.GIP.45568 Win-Trojan/Gip.45990 Trojan.PSW.Gip.1_12 Trojan.PWS.Gip.EJ Trojan.PSW.Gip.112 Trojan-PWS.Win32.Gip W32/GIP.112!tr Gip.1_12


A backdoor also known as: Trojan.Mezzia.CV Trojan.Mezzia TrojanDropper:Win32/Pakks.A Trojan.Mezzia.CV Worm.Mail.Win32.Zhelatin.hd Dropper.Small.29.E


TrendMicro has recently discovered a Trojan Android ad library called Xavier Detected by Trend Micro as ANDROIDOS_XAVIER.AXM that steals and leaks a user's information silently.


Recently, we observed a new version of the Clayslide delivery document used to install a new custom Trojan whose developer calls it ALMA Communicator


BernhardPOS is named after presumably it's author who left in the build path of C:\bernhard\Debug\bernhard.pdb and also uses the name Bernhard in creating the mutex OPSEC_BERNHARD


A backdoor also known as: W32/Autorun.worm.f Worm.VB.Win32.714 Trojan.Heur.9nKfrjYfrwgib W32/Worm.LUOA-4933 W32.SillyFDC Trojan.Win32.Coba.czqfat Worm.Win32.VB.110592 Win32.Trojan.Fakedoc.Auto BehavesLike.Win32.Trojan.tz Worm.Win32.VB W32/Worm.APSB Worm:Win32/Fakeon.A!bit HEUR/Fakon.mwf W32/ExeFolder.E.worm Worm.VB!Ly8UmpRsepM Win32/RootKit.Rootkit.7e5


A backdoor also known as: Trojan.Heur.AutoIT.7 Win.Trojan.Autoit-271 TR/Spy.438784.57


A backdoor also known as: Ransom/W32.GandCrypt.229376.B Trojan.Gandcrypt Troj.Ransom.W32!c Ransom_GandCrypt.R002C0WB618 Win32.Trojan.WisdomEyes.16070401.9500.9998 Ransom_HPGANDCRAB.SMONT Trojan-Ransom.Win32.GandCrypt.bw Trojan.Win32.Kryptik.exorqv TrojWare.Win32.Ransom.GandCrypt.A BehavesLike.Win32.Trojan.dc Trojan/Win32.Magniber.C2395866 Trojan-Ransom.Win32.GandCrypt.bw W32/Injector.DVHR!tr


A backdoor also known as: Trojan.Multi Spyware.PasswordStealer Backdoor.Androm.Win32.48978 Uds.Dangerousobject.Multi!c Win32.Trojan.WisdomEyes.16070401.9500.9547 Backdoor.Win32.Androm.oxvy Trojan.Win32.Androm.exigvu Trojan.PWS.Banker1.24888 BehavesLike.Win32.Fareit.ft Trojan.Win32.Injector TR/Dropper.VB.hvcaz Trojan[Backdoor]/Win32.Androm Backdoor.Win32.Androm.oxvy Trojan/Win32.VBKrypt.R218732 Backdoor.Androm Trj/GdSda.A Win32.Backdoor.Androm.Wvaq W32/FareitVB.DVIL!tr Win32/Trojan.5a2


This rootkit family called Umbreon sharing the same name as the Pokémon targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well.


A backdoor also known as: Trojan-Downloader.Win32.Delf!O Backdoor.Ginwui Win32.Trojan-Dropper.Delf.bc W32/Trojan2.JUQE PE_GINWUI.AP Win.Downloader.80081-1 Trojan-Downloader.Win32.Delf.ccc Trojan.Win32.Delf.uhoo Troj.Dropper.W32.Delf.li4k Win32.Trojan-downloader.Delf.Taex Trojan.DownLoad3.11310 Downloader.Delf.Win32.28823 PE_GINWUI.AP BehavesLike.Win32.Kespo.fc W32/Trojan.ZLPI-8330 TrojanDownloader.Delf.fdg TR/Ghimpe.dll Trojan[Downloader]/Win32.Delf Trojan.Graftor.D7EE4 Trojan.Win32.Downloader.54960 Trojan-Downloader.Win32.Delf.ccc Backdoor:Win32/Ginwui.D Trojan/Win32.Xema.R106631 Win32/TrojanDropper.Delf.OCT Trojan.DL.Delf!lmsXQwcGhNs Trojan-Dropper.Win32.Interlac TrojanDownloader.Delf


A backdoor also known as: Trojan-Downloader.Win32.Tiltee TrojanDownloader:Win32/Tiltee.A


A backdoor also known as: W32.Superboy Trojan.Vir.HLL Virus.Supeboy.Win32.1 Trojan.Heur.E3C718 TROJ_SUPEBOY.A W32/Superboy.MNPI-1152 TROJ_SUPEBOY.A Win.Trojan.Supeboy-1 Virus.Win32.HLLW.Supeboy Virus.Win32.HLLW.ghqc Trojan.Win32.Downloader.11776.D W32.HLLW.Supeboy!c Win32.HLLW.Supeboy.A W32/Supeboy.worm Trojan/SuperBoy.DelRegBackup W32/HLLW.Supeboy.A Virus/Win32.Supeboy Virus.Win32.HLLW.Supeboy W32/Supeboy.worm Trojan.Worm Win32/HLLW.Supeboy.A Win32.Virus.Hllw.Akeq Win32.HLLW.Supeboy.B Virus.Win32.HLLW Win32/Virus.BO.621


A backdoor also known as: W32.AppdataAdobLnrC.Trojan Net-Worm.Win32.Cynic!O Worm.Cynic Worm.Cynic.Win32.96 Win32.Trojan.WisdomEyes.16070401.9500.9997 Net-Worm.Win32.Cynic.iu Trojan.Win32.Bot.crrkzb BackDoor.IRC.Bot.1244 BehavesLike.Win32.Downloader.ct TR/Zbot.var Worm[Net]/Win32.Cynic Worm:Win32/Vexral.A Trojan.Barys.657 Worm.Win32.A.Net-Cynic.95744 Net-Worm.Win32.Cynic.iu Trojan/Win32.IRCBot.R23264 Worm.Cynic Win32/AutoRun.IRCBot.II Trojan.Injector!y7pxtOpaO3Y Net-Worm.Win32.Cynic W32/Injector.HXK!tr


Like several of the newer variants of ransomware, it does not require an internet connection to encrypt the files.


A backdoor also known as: Trojan-Spy/W32.QQLogger.236036.B TrojanPWS.QQthief.BI4 Trojan/Spy.QQLogger.aby Trojan.Win32.QQLogger.bdqigk Phisher.CZ Trojan.Spy-85326 Trojan-Spy.Win32.QQLogger.ado TrojanSpy.QQLogger!0FayLe3uYlk Trojan.PWS.Qqpass.6867 TrojanSpy.QQLogger.ct Win32.Troj.QQLogger.kcloud PWS:Win32/QQThief.I Spyware/Win32.QQLogger Virus.Win32.Part.a TrojanSpy.QQLogger Trojan.PSW.Win32.QQThief.j Trojan-Spy.Win32.QQLogger W32/QQLogger.CDX!tr


A backdoor also known as: Dropped:Backdoor.BlueFire.0.5.0 Backdoor/W32.BlueFire.593408 Backdoor.Bluefire Backdoor/BlueFire.036 BKDR_BLUEFIRE.A W32/Risk.VCME-1818 Construction.Kit BKDR_BLUEFIRE.A Win.Trojan.Bluefire-5 Backdoor.Win32.BlueFire.036 Dropped:Backdoor.BlueFire.0.5.0 Trojan.Win32.BlueFire.gaiw Backdoor.W32.BlueFire.036!c Dropped:Backdoor.BlueFire.0.5.0 Backdoor.Win32.BlueFire.036 Dropped:Backdoor.BlueFire.0.5.0 BackDoor.BlueFire.36 Backdoor.BlueFire.Win32.12 Backdoor/BlueFire.036 W32.Trojan.Backdoor-BlueFire BDS/BlueFire.50.DLL Trojan[Backdoor]/Win32.BlueFire Backdoor.BlueFire.0.5.0 Backdoor.Win32.BlueFire.036 Backdoor:Win32/BlueFire.0_36 Trojan/Win32.BlueFire.R61616 Dropped:Backdoor.BlueFire.0.5.0 Backdoor.BlueFire Win32/BlueFire.036 Win32.Backdoor.Bluefire.Tayj Backdoor.BlueFire!vtgAlnbXp+8 Backdoor.Win32.Way W32/Bdoor.UZ!tr.bdr


However, the attack is different in two respects: unlike other APTs, the main focus of Blue Termite is to attack Japanese organizations; and most of their C2s are located in Japan.


A backdoor also known as: Trojan.Crypt.ED Dropper.Binder.Win32.1016 Trojan/Dropper.Binder.qd Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/DropperX.VWP Trojan.Crypt.ED Backdoor.Win32.Rbot.abwp Trojan.Crypt.ED Trojan.Crypt.ED BackDoor.Shell BehavesLike.Win32.Backdoor.bh W32/Risk.ZNPN-3988 TrojanDropper.Binder.ht Trojan.Crypt.ED Backdoor.Win32.Rbot.abwp Backdoor:Win32/Blackhole.U Backdoor/Win32.Hupigon.R7788 Trojan.Crypt.ED Backdoor.Shell


A subsequent investigation revealed that the spyware has the following capabilities : Records every phone call ( literally the conversation as a media file ) , then sends it together with the caller id to the C & C ( incall3.php and outcall3.php ) Logs every incoming SMS message ( SMS body and SMS sender ) to C & C ( script3.php ) Has capability to hide self Can send all call logs ( “ content : //call_log/calls ” , info : callname , callnum , calldate , calltype , callduration ) to C & C ( calllog.php ) Whenever the user snaps a picture , either with the front or rear camera , it gets sent to the C & C ( uppc.php , fi npic.php orreqpic.php ) Can send GPS coordinates to C & C ( gps3.php ) The C & C server to which the application seems to be sending collected data appears to be operational , as of this writing , and running since May 2018 .


A backdoor also known as: Trojan.Trojan.Crypt.52 TSPY_EMOTET.SMD3 Win32.Trojan.WisdomEyes.16070401.9500.9999 TSPY_EMOTET.SMD3 Trojan.Win32.Diple.euwotz TrojWare.Win32.Crypt.AX BehavesLike.Win32.Ramnit.dc W32.Trojan.Emotet Trojan:Win32/Diple.B!bit Trojan/Win32.Magniber.R212688 Trojan.Win32.VB Win32/Trojan.d4d


Windows and winzip do not natively extract them which delivers some malware.


A backdoor also known as: Trojan-Dropper.Win32.Halk!O Backdoor.CIA BKDR_NERTE.780 Backdoor.Win32.NerTe.780 Backdoor.Win32.Nerte_780.Inst[h] Backdoor.Win32.NerTe.780 Trojan.MulDrop.1253 BKDR_NERTE.780 W32/Risk.YHOK-6554 BDS/Nerte78.Inst Win32.Hack.NerteZip.kcloud Backdoor:Win32/Nerte.7_80.dr Bck/Iroffer.BG Win32/NerTe.78.Client W32/NerTe.V780!tr.bdr BackDoor.Nerte Backdoor.Win32.NerTe.ajn


These campaigns have lead to a rapid rise in the rate of Bedep infections, with Arbour Networks observing just above 80K infections over a 3-day period.


A backdoor also known as: Win32.TrojanSpy.Banker.ahy.f W32/Packed_Upack.H Trojan-Banker.Win32.Banker.etk Packed.Win32.UPack Trojan.PWS.Banker.based Trojan-Banker.Win32.Banbra!IK Trojan-Banker.Win32.Banbra PSW.Banker Trj/Banker.ITS


A backdoor also known as: W32.HostsMsasc.Trojan Trojan.Win32.Inject!O Trojan.Zusy.D7CC Win32.Trojan.WisdomEyes.16070401.9500.9998 TROJ_PAM_000002012C.T3 Win.Trojan.Inject-7728 Trojan.Win32.Inject.dcduro Trojan.Win32.A.Llac.419328 Trojan.MulDrop3.3872 Trojan.Injector.Win32.50089 Trojan-Spy.MSIL TrojanDropper.Injector.kgt TR/Jorik.AC Trojan/Win32.Shakblades TrojanSpy:MSIL/VB.M Trojan/Win32.Jorik.C97808 Worm.Shakblades Worm.Ainslot!/rTzgf3sAsw


On July 16, 2015, the Palo Alto Networks Unit 42 threat intelligence team discovered a watering hole attack on the website of a well-known aerospace firm.


MalumPoS was designed to be configurable.


A backdoor also known as: Virtool.8944 Server-Proxy.Win32.CCProxy!O W32/HackTool.CYA not-a-virus:Server-Proxy.Win32.CCProxy.63 Virtool.8944 Riskware.Win32.CCProxy.ybka Virtool.8944 Win32.ServerProxy.CCProxy.~BAAB Program.CCProxy W32/Tool.YSPN-2643 AdWare/CCProxy.b GrayWare[Server-Proxy]/Win32.CCProxy HackTool:Win32/CCProxy.B Virtool.D22F0 not-a-virus:Server-Proxy.Win32.CCProxy.63 Virtool.8944 Win-AppCare/Ccproxy.987136 Virtool.8944 not-a-virus:Server-Proxy.Win32.CCProxy


The source and destination addresses are both blank without an actual email address.


Unit 42 also tracks the APT3 group using the name UPS, which is an intrusion set with Chinese origins that is known for having early access to zero-day vulnerabilities and delivering a backdoor called Pirpi.


Most security vendors fail to identify the malicious code 7/55 on virustotal


VBS malware, likely deployed as part of a red team


A backdoor also known as: W32.OnGamesMSIMOB.Trojan Worm.Win32.FakeFolder!O Trojan.Fakefolder.C4 Worm.FakeFolder.Win32.23 W32/FakeFolder.ADPV-1915 W32.SillyFDC Win32/SillyAutorun.FIA TSPY_FAKEALERT_BH010146.TOMC Win.Trojan.Fakefolder-76 Worm.Win32.FakeFolder.a Worm.Win32.A.FakeFolder.26624[UPX] TSPY_FAKEALERT_BH010146.TOMC BehavesLike.Win32.PWSBanker.tc Trojan.Win32.Fakefolder W32/FakeFolder.A Worm/FakeFolder.b Worm/Win32.FakeFolder Trojan:Win32/Fakefolder.C Worm.Win32.FakeFolder.a Trojan/Win32.FakeFolder.R143433 Worm.FakeFolder Win32.Worm.Fakefolder.Wmim Worm.FakeFolder!qDF5E1Kz9pU


Similar to previous attacks, the Disttrack malware used by Shamoon is just the destructive payload.


A backdoor also known as: TjnClicker.Qaccel.S1448 Trojan.Small.Win32.31852 Trojan/Clicker.Small.ndn Trojan.Win32.Click3.erajhs TrojWare.Win32.TrojanClicker.Small.DS Trojan.Click3.21941 TR/Dropper.tstkm GrayWare[AdWare]/Win32.TrojanClicker.Small.ndn Trojan/Win32.Dynamer.R187373 Backdoor.Bot Trojan.Win32.TrojanClicker


A macOS malware agent, named MacDownloader, was observed in the wild as targeting the defense industrial base, and reported elsewhere to have been used against an human rights advocate.


A backdoor also known as: W32.Clod740.Trojan.4797 Backdoor.Bittaru!1goVteZqWDk TROJ_SPNR.15KL11 MalCrypt.Indus! BDS/Bittaru.A.4 TROJ_SPNR.15KL11 Win32.Troj.Undef.kcloud Backdoor:Win32/Bittaru.A W32/Trojan.PAFV-2148 W32/BackDoor.DPM!tr


A backdoor also known as: Trojan.MSIL.Disfa


A backdoor also known as: MemScan:Trojan.Glitch.A Trojan-Dropper.Win32.Juntador!O MemScan:Trojan.Glitch.A Trojan/Dropper.Juntador.c Trojan.Glitch.A W32/Dropper.ATCT Backdoor.IRC.Zcrew TROJ_JUNTADOR.C Win.Dropper.Juntador-12 MemScan:Trojan.Glitch.A Trojan-Dropper.Win32.Delf.hq MemScan:Trojan.Glitch.A Trojan.Win32.Juntador.diov MemScan:Trojan.Glitch.A TrojWare.Win32.TrojanDropper.Juntador.c0 MemScan:Trojan.Glitch.A BackDoor.DMoon Dropper.Juntador.Win32.230 TROJ_JUNTADOR.C BehavesLike.Win32.Dropper.hc W32/Risk.HJDZ-9373 TrojanDropper.Win32.Juntador.c TrojanDropper:Win32/Juntador.C Trojan-Dropper.Win32.Delf.hq Trojan/Win32.LdPinch.C10075 Win32/TrojanDropper.Juntador.C Win32.Trojan-dropper.Delf.Eegz Trojan-Dropper.Win32.Juntador.C Win32/Trojan.bf1


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 Script.Application.CdEject.A Script.Application.Cdeject!c BehavesLike.Win32.PUPXBC.dc Joke:VBS/CDEject.D PUP.Linkury/Variant Trojan.Ejectcd.A VBS/CDEject.I Backdoor.MSIL.Bladabindi VBS/CDEject.I!tr


Symantec has identified a previously unknown group called Sowbug that has been conducting highly targeted cyber attacks against organizations in South America and Southeast Asia and appears to be heavily focused on foreign policy institutions and diplomatic targets.


This disabled the attacker's access to their victims in this campaign, provided further insight into the targets currently victimized in this operation, and enabled the notification of affected parties.


Finally, Doctor Web's security researchers investigated the Linux.Mirai Trojan found later that month.


A backdoor also known as: Virus.Win32.Sality!O Backdoor.Poison.Win32.26527 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.VBKrypt.hjcg Trojan.Win32.VB.dodqqz Troj.W32.VBKrypt.hjcg!c Trojan.MulDrop2.20812 Backdoor/Poison.eqy Trojan/Win32.VBKrypt TrojanDownloader:Win32/Tyqui.B Trojan.Win32.VBKrypt.hjcg Trj/CI.A Win32/TrojanDownloader.VB.ODM Trojan.VBKrypt!ngQI4PCHe4I Backdoor.Poison W32/Dx.TQG!tr


A backdoor also known as: PERL/Shellbot.B Backdoor.Perl.Shellbot.B Perl/Shellbot.PR Perl.Backdoor.Shellbot.f Unix/ShellBot.AH IRC.Backdoor.Trojan Perl/Shellbot.NAI PERL_SHELBOT.SMO Win.Trojan.Perlbot-1 Backdoor.Perl.IRCBot.ij Backdoor.Perl.Shellbot.B Backdoor.Perl.Ircbot!c Perl.Backdoor.Ircbot.Akpo Backdoor.Perl.Shellbot.B Backdoor.Perl.Shellbot.B Perl.Ircbot.93 PERL_SHELBOT.SMO Unix/ShellBot.AH PERL/Shellbot.aa Perl/IRCBot.I!tr Backdoor.Perl.Shellbot.B Backdoor.Perl.IRCBot.ij Backdoor:Perl/Shellbot.Z Backdoor.Perl.Shellbot.B Perl.Shellbot.I Trojan.Perl.Shellbot Backdoor.Perl.Shellbot.B Win32/Trojan.BO.811


A backdoor also known as: Backdoor.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9928 W32/Trojan.GELV-4208 Backdoor.MSIL.Bladabindi.akrb Trojan.Win32.Bladabindi.extavb Backdoor.Msil.Bladabindi!c Msil.Backdoor.Bladabindi.Wmjd BackDoor.Bladabindi.13678 Backdoor.Bladabindi.Win32.8723 Trojan.MSIL.Injector Trojan:Win32/Vb.At TR/Crypt.fkm.udrkf Trojan[Backdoor]/MSIL.Bladabindi Trojan.MSIL.Bladabindi.1 Trojan.Win32.Z.Bladabindi.192000.A Backdoor.MSIL.Bladabindi.akrb Trojan:MSIL/Inmalsal.A MSIL/Kryptik.GJY!tr Trj/GdSda.A Win32/Trojan.BO.610


A backdoor also known as: Constructor.Win32.Houndhack!O Backdoor.Venik.MUE.J2 Trojan/Farfli.bwm BKDR_VENIK_EL150010.UVPM Constructor.Win32.Houndhack.a Riskware.Win32.Houndhack.erbccv Trojan.DownLoader17.62076 BKDR_VENIK_EL150010.UVPM BehavesLike.Win32.Backdoor.dc HackTool[Constructor]/Win32.Houndhack Trojan.Zusy.D35C86 Constructor.Win32.Houndhack.a Backdoor:Win32/Venik.J Backdoor/Win32.Venik.R169912 Constructor.Houndhack Constructor.Houndhack! Trojan.Constructor


A backdoor also known as: Application.BitCoinMiner.ZM Trojan.BitMiner Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Win32.BitCoinMiner.agl Riskware.Win64.BitMiner.ewyekq BehavesLike.Win32.AdwareLinkury.vc PUA/CoinMiner.B Trojan/Win32.BitCoinMiner Trojan.Win32.BitCoinMiner.agl Trojan.Win32.BitcoinMiner


A backdoor also known as: Trojan.Win32.Small!O Trojan.Maptsc Trojan.Small.Win32.19366 Trojan.Heur.RP.EAC7EB TROJ_SMALL.NHQ Trojan.Win32.Small.cpb Trojan.Win32.Small.ebpbhy Troj.W32.Small.cpb!c Trojan.Click2.55177 TROJ_SMALL.NHQ Trojan.Win32.Small W32/Trojan.ZWIN-6050 Trojan/Small.ovd TR/Spy.6656.172 Trojan/Win32.Small Trojan:Win32/Maptsc.A Trojan.Win32.Small.cpb Trojan/Win32.Connapts.C256364 Trojan.Small.cpb Trojan.Small Win32.Trojan.Small.Edod Trojan.Click!cGVrs+boA6s Win32/Trojan.4c4


More information from PWC about Sofacy Bedep malware using DGA CozyDuke aka CozyBear, CozyCar or Office Monkeys is a threat actor that became increasingly active in the 2nd half of 2014 and hit a variety of targets.


In the email screenshot with our added machine translation from Russian, notice the subject line and message body text reflecting a business customer upset about extra charges on his credit card social engineering theme.


A backdoor also known as: W32.GarusenV.Trojan Worm/W32.Vobfus.225280 Worm.Win32.Vobfus!O W32/Vobfus.io Trojan.Barys.950 WORM_VOBFUS.SM02 Win32.Trojan.VBObfus.f WORM_VOBFUS.SM02 Win.Trojan.Vobfus-28 Worm.Win32.Vobfus.biec Trojan.Win32.WBNA.cihuhh Worm.Win32.A.Vobfus.225280 TrojWare.Win32.Pronny.EE Trojan.VbCrypt.60 BehavesLike.Win32.VBObfus.dm Worm.Win32.Vobfus Worm/WBNA.dfdh WORM/Vobfus.dbmnua Worm.Win32.Vobfus.biec Trojan/Win32.Vobfus.R36953 BScope.Trojan.Diple Win32/Pronny.EJ W32/Vobfus.GEW.worm


These have been the attacks on Saudi Arabian companies where a destructive malware known as Disttrack was deployed.


In addition, we found that the infrastructure used in this case overlaps with FindPOS/PoSeidon as well as Chanitor and sits amidst a cluster of largely indiscriminate malicious activity.


A backdoor also known as: Trojan/W32.Chifrax.150357 Trojan.Chifrax.rw5 Trojan/Chifrax.a BKDR_POISON.VA W32/Poison.AX Backdoor.Odivy Win32/Poison.AAE BKDR_POISON.VA Win.Trojan.Poison-11 Trojan.Win32.Chifrax.a Trojan.Win32.Chifrax.fwpet Trojan.DownLoader9.38925 Trojan.Chifrax.Win32.1349 BehavesLike.Win32.Dropper.cc W32/Poison.HQGF-3018 Trojan/Chifrax.epp TR/Drop.PoisonIvy.C.1 W32/Chifrax.A!tr Trojan/Win32.Chifrax Troj.W32.Chifrax.a!c TrojanDropper:Win32/Poisonivy.C Win-Trojan/Poisonivy.150357 Trojan.Chifrax Win32/Poison.NGS Win32.Trojan.Chifrax.Wskn Trojan.Chifrax!Xo07JnrMN1M Trojan.Win32.Chifrax Trj/Chifrax.C Win32/Trojan.954


A backdoor also known as: AIT:Trojan.Autoit.CLU Win32.Trojan-Dropper.Autoit.l W32/Trojan.TWFF-1697 AIT:Trojan.Autoit.CLU Trojan.Win32.Beast.exaenx AIT:Trojan.Autoit.CLU BackDoor.Beast BehavesLike.Win32.PUPXAI.dh AIT:Trojan.Autoit.CLU Trojan.Autoit.F AIT:Trojan.Autoit.CLU AIT:Trojan.Autoit.CLU Trj/CI.A Win32/Trojan.0fc


Chikdos is a malware that targeted MySQL servers to make them conduct distributed denial-of-service DDoS attacks against other websites.


A backdoor also known as: Backdoor.Tartober BKDR_TARTOBER.A Win32.Trojan.WisdomEyes.16070401.9500.9999 BScope.Trojan-Spy.Zbot BKDR_TARTOBER.A Trojan.Win32.Wisp.zraky BackDoor.Wisp.11 BehavesLike.Win32.Trojan.dc W32/Trojan.TTYH-5266 Trojan.Zusy.Elzob.D39B5 Backdoor:Win32/Tartober.A Trj/CI.A Win32/Trojan.e6d


A backdoor also known as: Ransom/W32.WannaCry.5267459.F Ransom.Zenshirsh.SL8 Ransom.WannaCrypt Trojan/Exploit.CVE-2017-0147.a Win32.Worm.Rbot.a Ransom.Wannacry Ransom_WCRY.SMJ Win.Ransomware.WannaCry-6313787-0 Win32.Exploit.CVE-2017-0147.A Trojan-Ransom.Win32.Wanna.m Trojan.Win32.Wanna.epxkni Trojan.Win32.WannaCry.5267459 Troj.Ransom.W32.Wanna.toP0 Trojan.Encoder.11432 Trojan.Wanna.Win32.98 Ransom_WCRY.SMJ BehavesLike.Win32.RansomWannaCry.tt Trojan.Wanna.k TR/WannaCrypt.ahdyg Trojan[Ransom]/Win32.Wanna Trojan:Win32/Eqtonex.F!dha Trojan-Ransom.Win32.Wanna.m Trojan/Win32.WannaCryptor.R200894 Hoax.Wanna Trj/GdSda.A Win32/Exploit.CVE-2017-0147.A Exploit.CVE-2017-0147! Trojan.Win32.Exploit W32/Wanna.M!tr


A backdoor also known as: Win32.TrojanPigax Trojan-Downloader.Win32.Small.akrf Trojan-Downloader.Win32.Small.akrf TR/Dldr.Small.akrf Trojan.Dldr.Small.akrf Trojan-Downloader.Win32.Small.akrf Trojan-Downloader.Win32.Small W32/Small.AKRF!tr.dldr Trj/CI.A


REDBALDKNIGHT, also known as BRONZE BUTLER and Tick, is a cyberespionage group known to target Japanese organizations such as government agencies including defense as well as those in biotechnology, electronics manufacturing, and industrial chemistry.


A backdoor also known as: Trojan.NaviPromo.3 Win32.Trojan.WisdomEyes.16070401.9500.9999 Win32/Lipler.B!packed TROJ_SKINTRI.SMC Trojan.Win32.Hrup.aah Troj.Downloader.W32.Lipler.lcwl TROJ_SKINTRI.SMC Trojan/Win32.Hrup Trojan:Win32/Skintrim.C Trojan.Win32.Hrup.aah Win32.Trojan.Hrup.Ajvd Trojan.Win32.Skintrim W32/Skintrim.CG!tr Win32/Trojan.IM.c6f


Ursnif campaigns against EU and mainly Italy spreaded by a JScript


A backdoor also known as: W32/Autorun.Worm.aaeh Win32.Trojan.WisdomEyes.16070401.9500.9867 TSPY_TEPFER.GB Trojan.Win32.VBTrojan.bvufrt TrojWare.Win32.VB.HR Trojan.DownLoader10.21377 TSPY_TEPFER.GB BehavesLike.Win32.Swisyn.cc Trojan:Win32/Beelog.C Trojan.Win32.Jorik.28672.A Trojan/Win32.Jorik.R44838 Trj/CI.A Win32/Trojan.Downloader.f2c


A backdoor also known as: W32.Yaha.S W32/Yaha.aa@MM Trojan.Heur.ED1374C Win32.Trojan.WisdomEyes.16070401.9500.9777 W32.Yaha.AE@mm Win32/Yaha.Y Win.Worm.Yaha-8 Email-Worm.Win32.Lentin.s Trojan.Win32.Lentin.emzf I-Worm.Win32.Yaha.60304 Win32.Worm-email.Lentin.Wvki TrojWare.Win32.Patched.KSU Win32.HLLM.Yaha.7 W32/Yaha.aa@MM WORM/Lentin.S Worm[Email]/Win32.Lentin Worm:Win32/Yaha.AA@mm Backdoor.W32.Bifrose.l4Wh Email-Worm.Win32.Lentin.s Trojan.Win32.Rbot


A backdoor also known as: Heur.Win32.Veebee.1!O Trojan.VB.rw3 Trojan.Happili Trojan.Inject!SEi/RTfcvEo W32/Backdoor2.HUHI TROJ_SPNR.0BD714 Trojan.Win32.Inject.kxez Trojan.Win32.Inject.cwbjpa Trojan.Boaxxe.2 Trojan.Inject.Win32.72022 TR/Dropper.VB.6820 TROJ_SPNR.0BD714 Trojan/Win32.Inject Win32.Troj.Inject.kx.kcloud W32/Backdoor.PZSO-6760 TScope.Trojan.VB Trj/WLT.A Win32/Boaxxe.BL Win32.Trojan.Inject.Sxek Virus.Win32.VBInject W32/Zbot.RZIM!tr


A backdoor also known as: Trojan-PWS/W32.Hukle.157044 Trojan.Hukle.Win32.18 Trojan/PSW.Hukle.o Trojan.PWS.Hukle!uPlO8aKf2dU W32/Trojan2.GWXZ Infostealer.Hukle TROJ_HUKLE.O Win.Trojan.Hukle-16 Trojan-PSW.Win32.Hukle.o Trojan.Win32.Hukle.dhvf Troj.PSW32.W.Hukle.o!c TrojWare.Win32.PSW.Hukle.~R Trojan.PWS.Hukle.145 TROJ_HUKLE.O BehavesLike.Win32.PWSZbot.ch W32/Trojan.TBYH-4941 Trojan/Hiddukel.t W32/Hukle.O!tr.pws Trojan[PSW]/Win32.Hukle Trojan.Zusy.Elzob.D3190 Win-Trojan/Hukle.151040 PWS:Win32/Hukle.O Trojan-PWS.Win32.Hukle Trojan.Win32.InfoStealer.o


The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation the same origin policy and Firefox's PDF Viewer.


The email message and the lure document are written in Hebrew, Arabic or English – depending on the target audience.


The adversary's campaign has active and operational Command and Control C2 servers.


A one-man cybercriminal operation that uses point-of-salePoS malware has stolen more than 22,000 unique credit card numbers from terminals in Brazil,Canada, and the United States in a span of just one month.


A backdoor also known as: W32/OnlineGames.LWBP Worm.Autorun-4618 Worm.Win32.Dropper.RA Trojan:W32/DelfInject.R Trojan.PWS.Wsgame.22668 Win32/Oflwr.A!crypt Heur:Trojan/PSW.OnlineGames BScope.HackTool.Sniffer.WpePro Trj/CI.A


A backdoor also known as: W32.FakelsasLTD1.Trojan Trojan.Win32.Small!O Trojan.Upatre.S1164383 Trojan/Downloader.Small.aab Win32.Trojan.Inject.bm W32/Trojan.TBSZ-0334 Win32/Upatre.Q TROJ_BANLOAD.KAV Win.Trojan.Rubinurd-67 Trojan.Win32.Small.cpl Trojan.Win32.Small.ciwsuw TrojWare.Win32.Injector.AH Trojan.DownLoad3.28161 Trojan.Bublik.Win32.12106 TROJ_BANLOAD.KAV BehavesLike.Win32.PWSZbot.dh Backdoor.Win32.Androm W32/Trojan3.GBH Trojan/Small.oxi Trojan/Win32.Bublik Trojan.Win32.Small.cpl Trojan:Win32/Dorv.D!rfn Worm/Win32.Palevo.C199836 Trojan.Small Trojan.Email.FA Trojan.Small.AAB Win32/TrojanDownloader.Small.AAB Trojan.Bublik!BrbaRvXyIc8 W32/Bublik.AAB!tr


A backdoor also known as: Trojan.Backdoor.80


A backdoor also known as: Ransom.Exxroute.A3 Trojan.Ransom.Lukitos.1 Ransom_CERBER.SM37 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Ramnit!dr Ransom_CERBER.SM37 Trojan.PWS.Sphinx.2 BehavesLike.Win32.Ransomware.cc Trojan:Win32/CeeInject.MJ!bit Trojan/Win32.Fareit.R189070 Trj/GdSda.A


A backdoor also known as: W32.WisdwslD.Trojan TrojanDownloader.Esaprof.A4 Trojan.Strictor.D542D Trojan.Esaprof Win32/SillyDL.YTP TROJ_ESAPROF_EK2501B4.UVPM SWF.Plicker.1 TROJ_ESAPROF_EK2501B4.UVPM BehavesLike.Win32.Dropper.wc TrojanDownloader:SWF/Esaprof.B Trojan.Win32.Downloader.3514368[UPX] Trojan.Downloader Trj/CI.A SWF/TrojanDownloader.Esaprof.A Trojan.Patched


A spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan who is likely based in Beijing, China.


A backdoor also known as: W32.SocksT.Trojan Worm.Win32.Socks!O Trojan.Zbot.EO4 Worm.Socks.Win32.38 W32.W.Socks.tnAV W32/Socks.ey TROJ_SPNR.14DL13 Win32.Trojan.Kryptik.el Win32/Tnega.McRJca TROJ_SPNR.14DL13 Win.Trojan.Ag-4254306-1 Worm.Win32.Socks.ey Trojan.Win32.Socks.wtnjo Worm.Win32.Socks.791340 BackDoor.FireOn.221 BehavesLike.Win32.VirRansom.tc Trojan-Spy.Zbot.BE Trojan/PSW.Almat.dwk W32.Infostealer.Zeus Worm/Win32.Socks Worm.Socks.ey.kcloud Worm.Socks Worm.Win32.Socks.ey Worm/Win32.Socks.C35688 Virus.Socks.ey Worm.Socks!MDTxLrvAMvg


Turla, which has been targeting governments, government officials and diplomats for years – see, as an example, this recent paper – is still using watering hole techniques to redirect potentially interesting victims to their C C infrastructure.


A backdoor also known as: W32.DostoxaLTB.Trojan Trojan.Mogoogwi.A3 WORM_MOGOOGWI.SMHA Win32.Trojan.WisdomEyes.16070401.9500.9996 WORM_MOGOOGWI.SMHA Trojan-Dropper.MSIL Trojan:MSIL/Mogoogwi.A Trojan.Barys.DC996 Trojan/Win32.Zusy.R154407 Trj/CI.A Win32/Trojan.65a


A backdoor also known as: Trojan.Dynamer.A8 Trojan.Ransom.Globe Win32.Trojan.WisdomEyes.16070401.9500.9595 Ransom.Purge Ransom_PURGE.SM1 Win32.Trojan-Ransom.Globe.A Trojan-Ransom.Win32.Purga.v Win32.Trojan.Purga.Hvjx Trojan.Encoder.6182 BehavesLike.Win32.Sytro.kc W32/Trojan.DXHE-6024 Trojan.CryFile.co Trojan[Ransom]/Win32.CryFile Troj.Ransom.W32!c Trojan-Ransom.Win32.Purga.v Ransom:Win32/Contentocrypt.A Trojan/Win32.CryFile.R186838 TrojanDropper.Dapato Ransom.Globe Trojan.Filecoder!iQ4fX8DOQ4o Trj/GdSda.A Win32/Trojan.Ransom.524


Taiwan has long been subjected to persistent targeting from espionage motivated threat actors.


This attack chain exposed millions of potential victims in the US, Canada, the UK, and Australia, leveraging slight variations on a fake browser update scheme that worked on all three major Windows web browsers.


Our investigation into these attacks has unearthed more details into the method by which the threat actors delivered the Disttrack payload.


We re constantly following, detecting and monitoring the lifecycle of these RATs as they appear, disappear and often reappear under a new moniker.


Shipping companies and medical laboratories in Asia are being targeted in a likely intelligence-gathering campaign that relies exclusively on publicly available and living-off-the-land tools.


A backdoor also known as: Trojan-Spy/W32.Small.8704.J Trojan-Spy.Win32.Small!O TrojanDownloader.Dielel Troj.Spy.W32.Small.jzk!c TROJ_GOGLOAD.A Win32.Trojan.WisdomEyes.16070401.9500.9995 W32/Trojan.IOOK-0066 TROJ_GOGLOAD.A Trojan-Spy.Win32.Small.jzk DLOADER.Trojan Trojan.Win32.Spy DangerousObject.Multi.bcf W32/Small.JZK!tr Trojan[Spy]/Win32.Small Win32.Troj.small.j.kcloud Trojan.Heur.LP.EEE6A9 Trojan-Spy.Win32.Small.jzk TrojanDownloader:Win32/Dielel.A TrojanSpy.Small Win32.Trojan-spy.Small.Iit


A backdoor targetting Linux also known as: Trojan.Linux.MiraiDDoS.BI Downloader.Mirai.Linux.8 Troj.Downloader.Linux!c ELF_MIRAI.A HEUR:Trojan-Downloader.Linux.Mirai.b Trojan.Linux.MiraiDDoS.BI Trojan.Mlw.ektbyu Trojan.Linux.MiraiDDoS.BI Trojan.Linux.MiraiDDoS.BI Linux.DownLoader.289 ELF_MIRAI.A LINUX/Dldr.Mirai.qqlgv Trojan[Downloader]/Linux.Gafgyt.b Trojan.Linux.MiraiDDoS.BI Linux.S.Mirai.1204 HEUR:Trojan-Downloader.Linux.Mirai.b TrojanDownloader:Linux/Mirai.A Backdoor.Linux.Mirai Linux.Trojan-downloader.Gafgyt.Amlt Trojan-Downloader.Linux.Mirai Trojan.Linux.MiraiDDoS.BI


A backdoor also known as: Win32.Worm.Verauto.A Win32.Worm.Verauto.A Trojan/VB.oda Win32.Worm.Verauto.A W32/VB.OO Virus.Win32.VB.b Win32.Worm.Verauto.A Virus.Win32.VB.gixe W32.VB.b!c Win32.Virus.Vb.Swum Win32.Worm.Verauto.A Virus.Win32.VB.b Win32.Worm.Verauto.A Win32.HLLW.Verauto Virus.VB.Win32.76 worm.win32.vobfus.cf W32/VB.YYAQ-1388 WORM/Verauto.A Virus/Win32.VB Worm:Win32/SillyVB.B Win32.Worm.Verauto.A Trojan.VB Win32/VB.ODA .Virus.EICAR_BOOV Worm.Win32.VB W32/VB.B!tr Win32/VB.BM


A backdoor also known as: TrojanSpy.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9866 Trojan.Win32.Downeks.exeslg Troj.Spy.Msil.Downeks!c Trojan.MSILPerseus.D21B6F TrojanSpy:MSIL/Tinclex.A Riskware.Confuser! Trj/GdSda.A Win32/Trojan.Spy.7a8


The malware, which has been identified by many vendors on VirusTotal, has been labeled by our researchers as Trojan.Chinad or just Chinad as an alternative short label.


The group behind the attacks is possibly associated with the Russian government and has been active since at least 2007.


A backdoor also known as: W32.HfsAutoB.BCDE Backdoor.Baceed Backdoor.Hupigon.Win32.11548 Backdoor.W32.Hupigon.torp W32/Backdoor2.EVBN Backdoor.Trojan Win.Trojan.Hupigon-27433 Backdoor.Win32.Hupigon.gklq Trojan.Win32.Hupigon.wnxa Backdoor.Win32.Hupigon.163840.I Backdoor.Win32.Hupigon.gklqo BackDoor.Pigeon1.8593 W32/Backdoor.ECNM-9194 Backdoor/Hupigon.jmk W32.Backdoor.Hupigon BDS/Baceed.hrhsh Trojan[Backdoor]/Win32.Hupigon Backdoor:Win32/Baceed.A!bit Backdoor.Win32.Hupigon.gklq Trojan/Win32.Hupigon.R42586 TScope.Malware-Cryptor.SB Win32.Backdoor.Hupigon.Pavs Backdoor.Win32.Hupigon Win32/Trojan.aab


A backdoor also known as: Trojan.Ransom.Crypt12 Ransom.Kristina Ransom_CRYPTWELVE.B Win32.Trojan.WisdomEyes.16070401.9500.9562 Ransom.CryptXXX Ransom_CRYPTWELVE.B Win.Ransomware.Kristina-6367716-1 MSIL.Trojan-Ransom.Crypt12.B Trojan.Win32.Encoder.evktgv Trojan.Win32.Z.Ransom.124928.G Trojan.Encoder.15080 Trojan.Filecoder.Win32.6738 Ransom.MSIL.Natiris W32/Trojan.ERVC-5011 TR/RedCap.khogd Ransom:MSIL/Natiris.A Trojan/Win32.Ransom.C2247299 Trj/GdSda.A Win32/Trojan.Ransom.15c


First we got the Linux variant, and with information extracted from its binary, we were able to find the variant for Windows desktops, too.


A backdoor also known as: Trojan.Esacel Win32.Trojan.WisdomEyes.16070401.9500.9998 Trojan.Win32.Kryptik.exqpjd Trojan.Kryptik.Win32.1351348 W32/Trojan.MCPS-3536 TR/Crypt.ZPACK.ocodu Trojan.Esacel Trj/CI.A Trojan.Kryptik!MH3d/6dQFBI Trojan.Inject Malicious_Behavior.SB


At FireEye Labs, we recently detected the resurgence of a coin mining campaign with a novel and unconventional infection vector in the form of an iFRAME inline frame – an HTML document embedded inside another HTML document on a web page that allows users to get content from another separate source and display it within the main web page – embedded in a PE binary Portable Executable Binary, or .exe.


A backdoor also known as: Trojan.QHost.ACI Trojan.Win32.Qhost!O Trojan.QHost.ACI TROJ_RENOS.TU Win32.Trojan.WisdomEyes.16070401.9500.9838 W32/Trojan.YCCB-6079 Trojan.Dropper TROJ_RENOS.TU Win.Trojan.Small-4579 Trojan.Win32.Qhost.abh Trojan.QHost.ACI Trojan.Win32.Qhost.slro Trojan.QHost.ACI TrojWare.Win32.TrojanDownloader.FakeAlert.G Trojan.QHost.ACI Trojan.Fakealert.399 BehavesLike.Win32.Dropper.nc W32/Trojan2.CMAE Trojan/Qhost.tf Trojan:Win32/Wantvi.C Trojan.Win32.Qhost.abh Trojan.QHost.ACI Trojan/Win32.Qhost.R34501 Trojan.QHost.ACI OScope.Hoax.Win32.FakeAlert Trojan.Qhost Win32/TrojanDownloader.FakeAlert.G Trojan.Qhost.EP Trojan.Win32.Qhost.abh W32/Qhost.ABH!tr


A backdoor also known as: Trojan-Downloader.Mediket.CD Troj.Downloader.W32.Mediket.cd!c Trojan/Downloader.Mediket.cd Win32.Trojan.WisdomEyes.16070401.9500.9810 W32/Downloader.JJGI-8097 Win32/SillyDl.FL Trojan-Downloader.Win32.Mediket.cd Trojan.Win32.Mediket.dkal Trojan.Win32.Downloader.10240.ES Trojan.DownLoader.7470 Downloader.Mediket.Win32.64 Trojan-Downloader.Win32.Mediket.bl W32/DldrX.DHK TrojanDownloader.Mediket.fv TR/Dldr.Mediket.S.2 Trojan[Downloader]/Win32.Mediket Trojan.Heur.amGfYI3rB7li Trojan-Downloader.Win32.Mediket.cd Trojan/Win32.Small.C140121 Trojan-Downloader.Win32.Mediket.ca Trojan-Downloader.Mediket.CD Win32.Trojan-downloader.Mediket.Ajvz W32/Dloader.CD!tr.dldr


A particular focus appears to have been placed on the healthcare industry.


A backdoor also known as: Trojan/W32.Small.6656.AAX Trojan.Win32.Small!O Trojan.Tosct Trojan.Heur.RP.EF49A0 TROJ_DLOADER.FAV Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.MPRY-6149 TROJ_DLOADER.FAV Trojan.Win32.Small.coy Trojan.Win32.Small.cwxndz Trojan.Click2.56220 Trojan.Small.Win32.19363 Trojan.Win32.Tosct Trojan/Small.ovb TR/Spy.6656.106 Trojan/Win32.Small Win32.Troj.Undef.kcloud Trojan.Win32.Small.coy Trojan:Win32/Tosct.A Trojan/Win32.Connapts.C256364 Trojan.Small.coy Trojan.Small Win32.Trojan.Small.Aiik Trojan.Small!nYMaRKVOefk W32/Dloader.FAV!tr


In these websites they hosted malware that was digitally signed with a valid, likely stolen code signing certificate


A backdoor also known as: Win32.Hybris.B@mm Email-Worm.Win32.Hybris!O Worm.Hybris W32/Hybris.dll@MM W95.Hybris.PI.msOW W32/Hybris.dll@MM WORM_HYBRIS.F Win32.Trojan.WisdomEyes.16070401.9500.9989 W32/Hybris.worm.B W95.Hybris.worm WORM_HYBRIS.F Win.Trojan.Hybris-10 Win32.Hybris.B@mm Email-Worm.Win32.Hybris.plugin Win32.Hybris.B@mm Trojan.Win32.Hybris.upukw Win32.Hybris Win32.Hybris.B@mm EmailWorm.Win32.Hybris.lki Win98.Vecna.23040 Worm.Hybris.Win32.8 BehavesLike.Win32.Virut.pm W32/Hybris.worm.B Worm/Hybris.c Worm[Email]/Win32.Hybris Worm:Win32/Hybris.C@mm Email-Worm.Win32.Hybris.plugin I-Worm/Hybris.Variant Win32.Hybris.B@mm W32/Hybris.Wsock Win32.Hybris.E2C45E Win32/Hybris.dll Win32.Worm-email.Hybris.Wuqu I-Worm.Hybris Email-Worm.Win32.Hybris.Based W32/Hybris.dll@mm Win32/Worm.Email-Worm.47d


Who is behind Judy ? The malicious apps are all developed by a Korean company named Kiniwini , registered on Google Play as ENISTUDIO corp .


A backdoor also known as: HW32.Packed.8BE3 Win32.Neveg.C@mm Worm/W32.Neveg.52294.B W32/Neveg.c@MM W32/Neveg.c Win32.Neveg.C@mm Trojan.Win32.Neveg.iclu W32/Neveg.D@mm W32.Neveg.C@mm Win32/Neveg.C WORM_NEVEG.C Worm.Neveg.C.4 Email-Worm.Win32.Neveg.c I-Worm.Neveg!ysm95GgJE50 I-Worm.Win32.Neveg.52294.C[h] W32.W.Neveg.c!c Win32.Neveg.C@mm Worm.Win32.Neveg.C Win32.Neveg.C@mm Win32.HLLM.Peerage Worm.Neveg.Win32.1 WORM_NEVEG.C BehavesLike.Win32.Ramnit.qc W32/Neveg.URKR-8484 Worm[Email]/Win32.Neveg Win32.Neveg.EB4884 Worm/Win32.MyDoom Worm:Win32/Neveng.C@mm Win32.Neveg.C@mm Worm.Neveg W32/Neveg.D.worm Win32.Worm-email.Neveg.Lpbl Email-Worm.Win32.Neveg.C Win32.Neveg.C@mm I-Worm/Neveg.C Worm.Win32.Neveg.C


Ahmed Mansoor is an internationally recognized human rights defender, based in the United Arab Emirates UAE, and recipient of the Martin Ennals Award sometimes referred to as a Nobel Prize for human rights .


A backdoor also known as: W32/Trojan.MOBS-7437 Win.Trojan.B-474 Virus.Win32.Virut.CE Trojan.Heur.LP.EE1B95 Backdoor:Win32/Liudoor.B!dha Backdoor/Win32.Liudoor.R192527 Trj/CI.A


A backdoor also known as: TrojanDropper.Dorkbot.II4 Backdoor.Bifrose.Win32.18816 Backdoor.Bifrose Trojan/Midgare.advf TROJ_DROPPER.SMS Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.Dropper Win32/Bifrose.KJ TROJ_DROPPER.SMS Win.Trojan.Bifrose-9522 Trojan.Win32.Midgare.bqxuse BackDoor.Bifrost.26217 BehavesLike.Win32.Downloader.kc Backdoor/Bifrose.ovy TR/Midgare.adjf Trojan[Backdoor]/Win32.Bifrose Win32.Hack.MnlessT.lo.88519 TrojanDropper:Win32/Dooxud.A Trojan.Graftor.D46F7 Backdoor.Win32.Bifrose.77824.N Trojan/Win32.Bifrose.R3685 Backdoor.Bifrose VirTool.Injector!nUBzjCDRby4 Trojan.Win32.Midgare


Proofpoint researchers originally discovered the Panda Banker malware in February, 2016.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9961 Trojan.Win32.Bladabindi.esnxij Trojan.Win32.Z.Bladabindi.116224.CW Worm.MSIL.Autorun Trojan.MSIL.Bladabindi.1 TrojanDownloader:MSIL/Prardrukat.A Trj/GdSda.A Win32.Trojan.Atraps.Taew Win32/Trojan.62b


Beginning on October 30, 2015, Palo Alto Networks began seeing instances of this new version of CryptoWall, which some researchers have begun calling version 4.


A backdoor also known as: W32.FakeFolderDAS.Trojan Backdoor.Win32.BlackHole!O Worm.RussoTuristo Worm.RussoTuristo.Win32.83 Trojan.Heur.E54A1B Win32/Russo.A Worm.Win32.RussoTuristo.f Trojan.Win32.Amorale.crsxml Worm.Win32.RussoTuristo.53326 Trojan.Win32.FakeFolder.pb Win32.HLLW.Amorale BehavesLike.Win32.Adware.qh Backdoor/Blackhole.bmv Worm/Win32.RussoTuristo Worm.Win32.RussoTuristo.f Worm/Win32.RussoTuristo.R58000 Worm.TycKa.K Worm.Win32.RussoTuristo Worm.Win32.FakeFolder.CI


In the past weeks on 6 August 2016, Cyberkov Security Incident Response Team CSIRT received a numerous Android malwares operating in different areas in Libya especially in Tripoli and Benghazi.


Since January 2016, discreet campaigns involving malware called Trojan.Odinaff have targeted a number of financial organizations worldwide.


The campaign Talos analysed focused on Brazilian users and also attempted to remain stealthy by using multiple methods of re-direction in an attempt to infect the victim machine.


A backdoor also known as: Trojan.Syamcrog Trojan.Ursu.D1107 Win.Trojan.Bifrose-10939 Trojan.Win32.Tiny.etjahi TR/Downloader.wgueo Trojan:Win32/Syamcrog.A Trojan.Refroso Trj/GdSda.A


Unfortunately, the ransomware developers were not apprehended and it now appears they have been biding their time before releasing a new ransomware.


Meanwhile, we have informed the Google Play security team about the RetroTetris app and are awaiting their response.


Adobe released a patch for the vulnerability on July 8, 2015.


The malware payloads observed to be associated with the Uyghur themed C2 domains so far consist of PlugX, Gh0st RAT, and Saker/Xbox, although there may be others that are yet to be discovered.


A backdoor also known as: BackDoor.RevetRat.2 BehavesLike.Win32.Trojan.cc


Not only that, but the Windows version was additionally equipped with a valid code signing signature.


This was followed by another great blog by McAfee on the same subject but my focus will be on a specific aspect mentioned in the RSA blog which is the exploit used. FireEye discovered a malicious docx exploiting a zero day vulnerability in Microsoft's Encapsulated Postscript EPS filter, in the summer of 2015.


The first trace of this tool in our telemetry data dates back to late 2015.


This report is a comprehensive description of the JSocket Remote Access Tool RAT, and its significant capability to control PCs, Linux machines, Macs and Android devices.


Earlier this month, FortiGuard Labs researchers published findings about a malware campaign exploiting a PowerPoint vulnerability.


While the cyber-world was still shaking under the destructive ExPetr/Petya attack that hit on June 27, another ransomware attack targeting Ukraine at the same time went almost unnoticed.


A backdoor also known as: Trojan.Johnnie.DB3AF Trojan.Win32.Clicker!BT W32/Trojan.IUSC-1586 TrojanClicker:MSIL/Youclick.A Trojan.Win32.Clicker!BT Trojan-Clicker.MSIL.Youclick


Recently, while researching attacks on targets in Thailand, Unit 42 discovered a tool that initially appeared to be a variant of the well-known PlugX RAT based on similar observed behavior such as the usage of DLL side-loading and a shellcode file.


YOUR PERSONAL ID: Personal ID of your computer, for example: 4df7065b1d049d098526344faaabf3f8


A backdoor also known as: W32.Sality.lak4 Trojan.Heur.EFE584 Win32.Trojan.WisdomEyes.16070401.9500.9961 Backdoor.Trojan Trojan-PSW.Win32.LdPinch.zie Trojan.DownLoader.origin BehavesLike.Win32.Virut.nt Trojan-PSW.Win32.LdPinch.zie


The international investigation into the 2014 Iguala Mass Disappearance was targeted with infection attempts using spyware developed by the NSO group, an Israeli cyber warfare company


In recent attacks they set up a fake VPN Web Portal and targeted at least five Israeli IT vendors, several financial institutes, and the Israeli Post Office.


A backdoor also known as: VB:Trojan.VBA.Downloader.BU X97M.Petya.A VB:Trojan.VBA.Downloader.BU X2KM_GOLDENEYE.B Xls.Dropper.Goldeneye-3 VB:Trojan.VBA.Downloader.BU Trojan.Script.DnlrObj.ejzqyq Troj.Downloader.Script!c VB:Trojan.VBA.Downloader.BU VB:Trojan.VBA.Downloader.BU X2KM_GOLDENEYE.B X97M/Downloader.au VB:Trojan.VBA.Downloader.BU Trojan:O97M/Goldeneye.A X97M/Downloader.au Trojan-Ransom.VBA.GoldenEye Macro.Trojan-Dropper.Petya.R O97M/Dropper.ALI virus.office.obfuscated.1


A backdoor also known as: Trojan-Dropper.Win32.Haed!O Trojan/Dropper.Haed.co TROJ_DROP.SMUS1 W32/Dropper.BJGT Backdoor.Trojan TROJ_DROP.SMUS1 Win.Trojan.Haed-1 Trojan-Dropper.Win32.Haed.eno Trojan.Win32.Drop.mqlso Troj.Dropper.W32.Haed.eno!c TrojWare.Win32.Kryptik.BAN Trojan.Click1.57099 Dropper.Haed.Win32.381 virus.win32.ramnit.j W32/Risk.OLFU-0240 TR/Drop.He4Hook.B W32/Haed.A!tr.dldr Trojan[Dropper]/Win32.Haed Trojan.Heur.JP.E9E07C Dropper/Win32.Haed.N349364692 AdWare.AdPlus Win32.Trojan-Dropper.Haed.cfsr Trojan-Downloader.Win32.Frethog


In recent months, the malware used in the EITest campaign has been ransomware such as Spora and Mole.


Example note:Please follow the instructions Send $300 worth of Bitcoin to following address: 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX


This specific APK was modified to include the malicious remote access tool RAT called DroidJack also known as SandroRAT, which would virtually give an attacker full control over a victim's phone.


While performing some research online, Unit 42 was able to identify the following sample, which is being labeled as Trojan.Win32.Seadask' by a number of anti-virus companies.


Truth be told, these are all likely just improvements by the author to fix bugs or simply a shift in approach to make signature matching more difficult rather then a completely new variant.


A backdoor also known as: TROJ_INJECT.YYTS Win32.Trojan.WisdomEyes.16070401.9500.9953 Infostealer.Limitail TROJ_INJECT.YYTS Trojan.Win32.Inject.dkhjux Trojan/Scarsi.uz W32.Tepfer.Uqxl TR/MailPassStlr.A.87 Trojan[Dropper]/Win32.FrauDrop Trojan:MSIL/Limitless.A Trojan/Win32.DarkKomet.C641651 TrojanDropper.Injector Trj/CI.A Trojan.Injector!yje4mrhO7hs


A backdoor also known as: Exploit.SWF.CVE-2012-0754.B Exploit/W32.CVE-2012-0754 Exp.SWF.CVE-2012-0754 Exploit.CVE-2012-0754 Exploit.SWF.CVE-2012-0754.a!c Trojan.Mdropper SWF/Exploit.CVE-2012-0754.A SWF_EXPLCVE.A Exploit.SWF.CVE-2012-0754.B Exploit.SWF.CVE-2012-0754.a Exploit.SWF.CVE-2012-0754.B Exploit.S.D-Encrypted.106604 Exploit.SWF.CVE-2012-0754.B Exploit.SWF.CVE-2012-0754.B Exploit.CVE-2012-0754.1 SWF_EXPLCVE.A Exploit-MSWord.o DOC/SWFDropper.A!Camelot TrojanDownloader.SWF.t Trojan[Exploit]/SWF.CVE-2012-0754.a Exploit:Win32/CVE-2012-0754.A Exploit.SWF.CVE-2012-0754.B Exploit.SWF.CVE-2012-0754.a Exploit-MSWord.o Exploit.SWF.CVE-2012-0754.a Win32.Exploit.Cve-2012-0754.Ajli Exploit.CVE-2012-0754.A Exploit.SWF.CVE-2012-0754 W32/SWFExp.AS!tr Win32/Trojan.Exploit.6a5


A backdoor also known as: Trojan.Win32.BHO!O TrojanDownloader.Gamup Trojan/BHO.obt Trojan.Zusy.D42D95 TROJ_STARTP.SML2 Win32.Trojan.BHO.n TROJ_STARTP.SML2 Win.Trojan.OnlineGames-65 Trojan-Downloader.Win32.Gamup.qjl Trojan.Win32.Gamup.ciurh Trojan.Win32.A.Downloader.409816[UPX] Troj.Downloader.W32.Gamup!c Trojan.DownLoad2.34122 Downloader.Gamup.Win32.146 BehavesLike.Win32.Backdoor.cc Trojan.Win32.StartPage TR/BHO.efkmnb Trojan[Downloader]/Win32.Gamup Trojan-Downloader.Win32.Gamup.qjl TrojanDownloader.Gamup Win32.Trojan-downloader.Gamup.Ebhc Win32/Trojan.f4f


During the past few weeks there has been an increase in malvertising attacks, for example via a series of compromises of open source Revive ad servers which is still continuing.


Utilizing AutoIT within a payload is unique because it is a legitimate management tool.


A backdoor also known as: Trojan.Batman.B Trojan/W32.Batman.24576 Trojan.Batman.B Trojan/Batman.b Trojan.Batman.B W32.BatmanTroj Win32/Batman.B TROJ_BATMAN.B Dos.Trojan.an-1 Trojan.Win32.Batman.b Trojan.Win32.Batman.dcuw Trojan.Win32.S.Batman.24576[h] Win32.Trojan.Batman.Efkt Trojan.Batman.B TrojWare.Win32.Batman.B0 Trojan.Batman.B Trojan.Batman.24576 Trojan.Batman.Win32.2 TROJ_BATMAN.B W32/Trojan.DVOK-6663 Trojan/Win32.Batman.b TR/Batman.B W32/Batman.B!tr Trojan/Win32.Batman Trojan.Batman.B Troj.W32.Batman.b!c Trojan:Win32/Batman.B Trojan/Win32.Batman.N15760 Trojan.Batman Trojan.Batman!bY5LWYbvsHM Trojan.Win32.Batman Trojan.Batman.B Trj/Batman.B Win32/Trojan.022


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9999 TrojWare.MSIL.Injector.AOX BackDoor.Blackshades.2 Trojan/Foreign.axc Trojan[Ransom]/Win32.Foreign Trojan:MSIL/Parpwuts.C Win32/Trojan.74b


A backdoor also known as: Trojan-Dropper.Win32.Daws!O TrojanDropper.Daws Win32.Worm.VB.sk W32.SillyFDC Trojan-Dropper.Win32.Daws.bkbb Trojan.Win32.Daws.dwunho Trojan.MulDrop4.55506 Dropper.Daws.Win32.11917 BehavesLike.Win32.VBObfus.vz Win32/Virut.bv Trojan[Dropper]/Win32.Daws TrojanDropper:Win32/Vimdop.A!bit Trojan.Razy.D1F32 Trojan-Dropper.Win32.Daws.bkbb Dropper/Win32.Daws.R88727 TScope.Trojan.VB Win32.Trojan-dropper.Daws.Wsug Trojan.DR.Daws!i7I48rjdKf8 Trojan.VB2


A backdoor also known as: Trojan-PWS/W32.WebGame.66136.T Trojan-GameThief.Win32.OnLineGames!O PWS.Zhengtu.BB3 Trojan/OnLineGames.ajcfn Trojan.Zusy.D2717 Win32.Trojan-PSW.OLGames.cm Infostealer.Onlinegame Win.Trojan.Onlinegames-14906 Trojan.Win32.OnLineGames.vtdwn Troj.GameThief.W32.OnLineGames.lulb TrojWare.Win32.GameThief.Magania.~NWABZ Trojan.PWS.Wsgame.34942 Trojan.OnLineGames.Win32.120767 BehavesLike.Win32.Vundo.kh Heur:Trojan/PSW.OnLineGames Trojan[GameThief]/Win32.OnLineGames PWS:Win32/Zhengtu.B!dll Trojan/Win32.OnlineGameHack.R23439 PWS-OnlineGames.ld TrojanPSW.OnLineGames.ai Trojan.Win32.OnlineGames.zt Trojan.PWS.OnLineGames!atUPCfHrrdw Trojan-Spy.OnLineGames W32/Onlinegames.WXA!tr Trojan.PSW.Win32.GameOnline.EN


A backdoor also known as: Trojan.Crypt.Delf.E Trojan.Crypt.Delf.E Trojan/Downloader.Dadobra.as Trojan.Crypt.Delf.E Trojan.DL.Dadobra!9AHkQxAvV1E W32/Bancos.APF Downloader.Trojan TSPY_BANKER.UV Trojan-Downloader.Win32.Dadobra.af Trojan.Crypt.Delf.E Trojan.Win32.Dadobra.cmicp Trojan.Win32.Downloader.375808.K[h] Trojan.Crypt.Delf.E Trojan.Crypt.Delf.E Trojan.DownLoader.2321 Downloader.Dadobra.Win32.410 TSPY_BANKER.UV TrojanDownloader.Dadobra.as Trojan[Downloader]/Win32.Dadobra TrojanDownloader:Win32/Dadobra.BM Troj.Downloader.W32.Dadobra.as!c Trojan/Win32.Dadobra Trojan.Crypt.Delf.E Trojan.Win32.Dadobra.af Trojan-Dropper.Delf W32/Delf.DOA!tr.dldr PSW.Banker.33.BG


A backdoor also known as: W32.VariantNetvat.Trojan Trojan.Netvat Backdoor.Trojan Trojan.Win32.Netvat.45056 Worm.Win32.Tenavt.A Trojan.DownLoader11.42361 BehavesLike.Win32.Downloader.pt W32/Trojan.SSPB-9075 Trojan:Win32/Netvat.E!Dll Trojan.Graftor.D29A7D Trojan/Win32.Menti.R124411 Win32.Trojan.Dropper.Heur Worm.Tenavt!JDujK3yXihg W32/Kryptik.DTAI!tr


However it's important to say that these attackers, and the toolset used, share a number of similarities with the BlackEnergy group, which conducted attacks against the energy industry in Ukraine in December 2015 and January 2016.


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9906 Trojan.Win32.PeaceDuke.gfb Trojan.Win32.Z.Peaceduke.3126830 Win32.Trojan.Peaceduke.Taow BehavesLike.Win32.Worm.vc TR/PeaceDuke.wuwtd Backdoor:Win32/Cozer.A!dha Trojan.Win32.PeaceDuke.gfb Trj/CI.A


A backdoor also known as: Win32/RiskWare.PEMalform.E W32.W.Otwycal.l4av Tool.YahooCrack HackTool.YahoCrack.21 HackTool:Win32/Yacra.2_1 HackTool.Win32.Yacra


The Trojan encrypts files on the compromised computer and adds the following prefix before file names: ISHTAR-


A backdoor also known as: Backdoor.Nethief.XP Backdoor/W32.Nethief.78611 Backdoor.Win32.Nethief!O Backdoor/Nethief.XP.a Win32.Trojan.WisdomEyes.16070401.9500.9612 W32/Nethief.K@bd Backdoor.Trojan Win32/Nethief.XP.A.Server BKDR_NETHIEFXP.A Backdoor.Nethief.XP Backdoor.Win32.Nethief.ek Backdoor.Nethief.XP Trojan.Win32.Nethief.dknn Backdoor.Win32.A.Nethief.78611[UPX] Win32.Backdoor.Nethief.Aiim Backdoor.Nethief.XP Backdoor.Win32.Nethief.XP.Server Backdoor.Nethief.XP BackDoor.NethiefXP Backdoor.Nethief.Win32.139 BKDR_NETHIEFXP.A BehavesLike.Win32.Virut.lc W32/Nethief.HBZO-6955 Backdoor/Nethief.XP BDS/Nethief.XP.A Trojan[Backdoor]/Win32.Nethief Win32.Hack.Nethief.XP.kcloud Backdoor.Nethief.XP Backdoor.W32.Nethief!c Backdoor.Win32.Nethief.ek Backdoor:Win32/NetThief_XP.B Trojan/Win32.HDC.C762 Backdoor.Nethief.XP Backdoor.Nethief Backdoor.Nethief!0mFzAwzISB0 Backdoor.Win32.Ceckno W32/Nethief.EK!tr.bdr Win32/Backdoor.048


A backdoor also known as: Trojan.MSIL Dropper/Win32.Injector


A backdoor also known as: W32.FamVT.ExpiroPC.PE Trojan.MSIL Win32.Trojan.WisdomEyes.16070401.9500.9593 Trojan.Evrial!G1 Trojan.Win32.Stealer.exjasr Trojan.PWS.Stealer.21117 BehavesLike.Win32.Backdoor.ch TR/PSW.CoinStealer.nvgeg Trojan.Win32.Z.Razy.139264.GJ Trojan:MSIL/Evrial.B MSIL.Packed.Kryptik.JH Trj/GdSda.A Win32/Trojan.322


Using an FTP server has some advantages.


The threat group continually updated the Nemesis malware during their ongoing access to the victim environment, deploying several different variants of the same tools and adding functionality between iterations.


A backdoor also known as: Trojan-PWS/W32.RedZone.406528 Trojan/PSW.RedZone.41 Win32/PSW.RedZone.41 TSPY_REDZONE.E Win.Spyware.62275-2 Trojan-PSW.Win32.RedZone.41 Trojan.Win32.RedZone.fqhw Trojan.Win32.A.PSW-RedZone.406528[h] Troj.PSW32.W.RedZone.41!c Win32.Trojan-qqpass.Qqrob.Dyzy TrojWare.Win32.PSW.RedZone.41 Trojan.PWS.RedZone.41 Trojan.RedZone.Win32.21 W32/Risk.MXEM-1318 Trojan/PSW.RedZone.41 TR/PSW.RedZone.41 Malware_fam.gw Trojan[PSW]/Win32.RedZone PWS:Win32/Redzone.4_1 TrojanPSW.RedZone Trojan.PWS.RedZone!tcLid0irw8w Trojan.Win32.PSW Win32/Trojan.PSW.087


A backdoor also known as: W32.Sality.PE Trojan.Dropper.UYL Virus/W32.Sality.D W32.Sality.U Trojan.Dropper.UYL Virus.Sality.Win32.25 Trojan.Dropper.UYL W32.SillyFDC Win32/Sality.AA WORM_SILLY.SMRP Trojan.Dropper.UYL Trojan.Win32.Crypted.cqxgku Trojan.Win32.Dropper.abl Trojan.Dropper.UYL Trojan.Dropper.UYL Win32.Sector.30 WORM_SILLY.SMRP BehavesLike.Win32.Sality.th Win32/HLLP.Kuku.poly2 W32/Sality.AT Worm:Win32/Enosch.A Win32.Virus.Sality.A HEUR/Fakon.mwf Virus.Win32.Sality.bakc Trojan.DataStealer.B Win32/Sality.NBA Win32.Sality.BL Trojan.Win32.Enosch W32/DataStealer.B!tr W32/Sality.AA Virus.Win32.Sality.I


A backdoor also known as: Backdoor.BLA.FC.3019 Variant.Kazy.msZ5 Win32.Trojan.WisdomEyes.16070401.9500.9999 Trojan.MulDrop4.60646 Trojan-PWS.MSIL PWS:MSIL/Mintluks.A


This attack is particularly effective since execution of WTP is not accompanied by a security warning and users have been conditioned to run the troubleshooter when it appears in Windows.


During ISSP Labs daily threat activity monitoring a new virus distribution campaign with a unique malware sample was discovered.


The attacks likely were initially delivered via spear-phishing e-mails, or as demonstrated by C0d0so0 in the past, legitimate websites that had been previously compromised then used as watering holes for the selected victims.


A backdoor also known as: W97M.Bendis.AU X97M.Dropper.ID W97M.Bendis.AU W97M.Downloader X2KM_DROPPER.NEZ W97M.Bendis.AU Trojan.Ole2.Vbs-heuristic.druvzi W97M.Bendis.AU W97M.Bendis.AU X2KM_DROPPER.NEZ X97M/Dropper.c HEUR.VBA.Trojan.d TrojanDropper:O97M/Credoor.A X97M/Dropper.d W97M.Bendis W97M.Bendis.AU


Indicators related to a group of attackers that have been targeting Japan for a few years and are responsible for recent breaches against Japanese targets


A backdoor also known as: Trojan.Rovnix.Win64.17 Troj.Win64.Rovnix!c Trojan.Win64.Rovnix.au Trojan.Win64.Mayachok.dsethy Trojan.Mayachok.19009 Trojan/Rovnix.f W32.Rovnix TR/Rovnix.I Trojan/Win64.Rovnix Trojan.Win64.Rovnix.au Trojan/Win64.Rovnix.R175307 Trojan.Rovnix Trj/Rovnix.B Win64.Trojan.Rovnix.Pdmr Trojan.Rovnix!6RUsEoDKtkI Trojan.Win64.Rovnix Win32/Trojan.52f


These .jar files are most often identified as Adwind.


A new Android banking trojan called Nexus has been promoted via a Malware-as-Service subscription service, but is still in its early stages, suggests security researcher Cleafy's analysis.


A backdoor also known as:


A backdoor also known as: Trojan.Ransom.AIG Trojan/W32.Xorist.13312.E Trojan-Ransom.Win32.Xorist!O Trojan.Ransom.FO4 Trojan.Ransom.AIG Win32.Trojan.Filecoder.g Ransom.CryptoTorLocker Ransom_XORIST.SMA Win.Trojan.CryptoTorLocker2015-1 Trojan.Ransom.AIG Trojan-Ransom.Win32.Xorist.lk Trojan.Ransom.AIG Trojan.Win32.Xorist.dxuuhl Trojan.Win32.A.Xorist.1268736 Trojan.Ransom.AIG TrojWare.Win32.Kryptik.ER Trojan.Encoder.94 Ransom_XORIST.SMA Trojan/Xorist.at TR/Ransom.Xorist.EJ Trojan[Ransom]/Win32.Xorist Trojan.Ransom.AIG Troj.Ransom.W32.Xorist.tnPf Trojan-Ransom.Win32.Xorist.lk Ransom:Win32/Sorikrypt.A Trojan/Win32.Xorist.R21676 Hoax.Xorist Ransom.FileCryptor Trj/RansomXor.A Trojan.Win32.CryptoTorLocker2015.a Trojan-Ransom.CryptoTorLocker215 Win32/Trojan.1ee


I am not sure what these are but am guessing at possibly Emotet banking Trojan


While most of the interest still lies in the public sector, more recent attacks were found targeting the following industries:Aviation Broadcasting Energy Financial Non-governmental organizations NGO Pharmaceutical Public sector Publishing Software


ESET contacted Eltima as soon as the situation was confirmed.


A backdoor also known as: Trojan.MalPack Trojan.Graftor.D69EE1 Win32.Trojan.Kryptik.pd Ransom_LOCKY.SMXA Trojan.Win32.Kryptik.evdsll Ransom_LOCKY.SMXA BehavesLike.Win32.Upatre.qh TrojanDownloader:Win32/Brucryp.G Trj/GdSda.A W32/Kryptik.EXPV!tr Win32/Trojan.160


A backdoor also known as: Trojan.Script.473379 Trojan/W32.Clicker.349278 Trojan.Clicker.r5 Trojan.Script.473379 Trojan.Win32.MLW.lvntl W32/MalwareF.CARP Trojan.ADH Trojan.Win32.Clicker.hd Trojan.Win32.S.Clicker.349278[h] Trojan.Script.473379 Trojan.Script.473379 Trojan.DownLoader6.110 BehavesLike.Win32.Dropper.fc W32/Risk.VMFK-0127 Trojan/Clicker.je Trojan.Script.D73923 Trojan:Win32/Gleishug.C Trojan.Script.473379 Trj/CI.A Win32.Trojan.Clicker.Hoye AdWare.FTat Trojan.Script.473379


In late 2014, ESET presented an attack campaign that had been observed over a period of time targeting Russia and other Russian speaking nations, dubbed Roaming Tiger


Its different modifications target mobile devices of Russian users from February 2015.


A backdoor also known as: W32.MasendosA.Trojan Worm.Win32.AutoRun!O Trojan.Tofsee.1 Win32.Trojan.WisdomEyes.16070401.9500.9997 Win.Worm.Autorun-6961 P2P-Worm.Win32.Palevo.idwe Trojan.Win32.Graz.vhpfw Worm.Win32.A.AutoRun.90112 TrojWare.Win32.Kryptik.JIU Win32.HLLM.Graz Worm.AutoRun.Win32.31130 BehavesLike.Win32.Downloader.kc Worm.Win32.Wergimog Worm/AutoRun.agqt TR/Offend.5523698 Worm[P2P]/Win32.Palevo Worm:Win32/Wergimog.A P2P-Worm.Win32.Palevo.idwe Worm/Win32.Cynic.R5955 Worm.AutoRun Win32/AutoRun.IRCBot.HL Win32.Worm-p2p.Palevo.Swub Worm.AutoRun!FV4PXQUzhXU Win32/Trojan.515


Over the past few months there has been a lot of research and press coverage on the Shamoon campaigns.


A sophisticated hacking group with suspected ties to cybercrime gangs operating in Eastern Europe is now actively targeting and breaching prominent, brand name restaurants in the U.S.


A backdoor also known as: Exploit.Win64 Exploit.Win64.Apolmy.ewzxbo Trojan.Win64.Dianti TR/Apolmy.paocz Trojan:Win64/Apolmy.A Trj/CI.A


This EPS exploit was assigned CVE-2015-2545.


A backdoor also known as: W32.Sality.mBZF Trojan.Win32.Clicker.bcgwsn Trojan.Click2.33988 Trojan.Win32.Alyak W32/Trojan.WWZX-6000 TR/Graftor.27537.200 Trojan/Win32.Unknown Backdoor:Win32/Kanav.D BScope.Trojan.Win32.Inject.2 Trj/CI.A Trojan.Symmi.DB644 Win32/Trojan.070


A backdoor also known as: Trojan.Clicker.Delf.JK Trojan-Clicker.Win32.Delf!O Trojan.Clicker.Delf.JK Win32.Trojan-Downloader.Delf.bq Win32/Bancos.QQM TROJ_CLICKER.ATG Win.Trojan.Delf-2308 Trojan-Clicker.Win32.Delf.ih Trojan.Clicker.Delf.JK Trojan.Win32.Delf.dxqhln Win32.Trojan.Delf.Eamx Trojan.Clicker.Delf.JK Trojan.Clicker.Delf.JK Trojan.Badjoke TROJ_CLICKER.ATG TrojanClicker.Delf.fq TR/Clicker.Delf.IH Trojan[Clicker]/Win32.Delf Trojan.Win32.Clicker.475648 Trojan-Clicker.Win32.Delf.ih Trojan.Clicker.Delf.JK Trojan/Win32.AdClicker.R5452 Trojan.Clicker.Delf.JK TrojanClicker.Delf Win32/TrojanDownloader.Delf.OVE Trojan.CL.Delf.BJTO Trojan-Dropper.Delf W32/Delf.YS!tr


A backdoor also known as: Trojan-Dropper.Win32.MultiJoiner!O Troj.Dropper.W32.Pincher.lfij Trojan.Heur.GM.11400100A0 Win32.Trojan.WisdomEyes.16070401.9500.9992 Win32/MicroJoiner.A TROJ_MULTIJOIN.A Trojan-Dropper.Win32.Microjoin.ap TrojWare.Win32.Spy.Zbot.AAT Trojan.MulDrop.613 BehavesLike.Win32.Trojan.vc Trojan-PWS.Win32.LdPinch TrojanDropper.MultiJoiner.13.b Win32.Troj.GaoPSGet.49893 TrojanDropper:Win32/MultiJoiner.A Trojan-Dropper.Win32.Microjoin.ap Dropper/Win32.Microjoin.C70525 Trj/Multijoiner.A Win32/TrojanDropper.MultiJoiner.13.B Trojan.DR.MultiJoiner.D


A backdoor also known as: Trojan-Downloader.Win32.Small!O Downloader.Small.16212 Win32.Trojan.WisdomEyes.16070401.9500.9891 Win32/Kotan.20.A Trojan-Downloader.Win32.Small.fbn Trojan.Win32.Kotan.hadu Troj.Downloader.W32.Small.fbn!c Win32.Trojan-Downloader.Small.cmak TrojWare.Win32.TrojanDownloader.Kotan Trojan.Kaotan Downloader.Small.Win32.3682 TrojanDownloader.Kotan.b W32.Malware.Downloader Win32.Troj.Kotan.kcloud TrojanDownloader:Win32/Kotan.A Trojan-Downloader.Win32.Small.fbn Trojan/Win32.HDC.C69071 TrojanDownloader.Small Win32/TrojanDownloader.Kotan Trojan.DL.Small!ILxLTxTzCnE Trojan-Downloader.Win32.Kotan


A backdoor also known as: W32.OnGamesLT180912HKGHAAI.Trojan Trojan-GameThief.Win32.OnLineGames!O Trojan/Dropper.Killav.lt Win32.Trojan.WisdomEyes.16070401.9500.9999 W32.Fiala.A Win.Trojan.Geral-941 Trojan-Dropper.Win32.Killav.lt Trojan.Win32.Killav.dqiwur Troj.Dropper.W32.Killav.lt!c Win32.Trojan-dropper.Killav.Sunr Backdoor.Win32.Popwin.~IT Trojan.KillProc.13934 Dropper.Killav.Win32.187 BehavesLike.Win32.PWSOnlineGames.mc Trojan-Downloader.Win32.Geral Trojan/PSW.Magania.amzf Trojan[Downloader]/Win32.Geral TrojanDownloader:Win32/Dogkild.S Trojan/Win32.OnlineGameHack.R38048 BScope.Trojan.SvcHorse.01643 Trj/Pupack.A Win32/AutoRun.KillAV.I Trojan.DR.Killav!1BWU2jDjRDE


A backdoor also known as: W32.FakeW7Folder.Fam.Trojan Trojan.Mauvaise.SL1 Trojan.Badur.Win32.8423 Trojan.Win32.Badur.dgkukl Win32.Trojan.Fakedoc.Auto TrojWare.Win32.Imwee.A BackDoor.Bulknet.1486 TR/Dldr.Imwee Trojan/Win32.Badur Trojan.Zusy.D39D62 Backdoor/Win32.Trojan.C753557 Win32/Trojan.IM.66a


A backdoor also known as: JS/Iframe.DGS Script.Trojan-Downloader.IFrame.AE Trojan-Downloader.JS.Iframe.deg Trojan.Script.Expack.bvtkmp PDF.DownLoader.3 BehavesLike.PDF.BadFile.db JS/BlacoleRef.CZ.29 Trojan[Downloader]/JS.Iframe.deg Trojan-Downloader.JS.Iframe.deg JS/Moat.241E54F!tr


Fileless threats and ransomware aren't new, but a malware that incorporates a combination of their characteristics can be dangerous.


A backdoor also known as: Win32.Trojan.Skillis.a W32/Trojan.PYDC-5827 W32.SillyFDC Win32/Oflwr.A!crypt Win32.Application.PUPStudio.A Trojan.Win32.Skillis.cqimdi Trojan.DownLoader21.39298 Trojan.Skillis.Win32.2785 TR/Drop.KillAV.A.69 Trojan/Win32.Unknown TrojanDropper:Win32/Killav.A Trojan/Win32.Backdoor.R142720 Trojan.Skillis Trojan.Win32.Skillis.aaa Trojan.PWS.Banbra!0kkWPO51+fM Win32.Outbreak W32/QQPass.ELG!tr.pws Win32/Trojan.7d3


A backdoor also known as: Trojan.Kazy.DAD1ED Win32.Trojan.WisdomEyes.16070401.9500.9998 W32/Trojan.ESEG-0989 Trojan.MSIL.Crypt.fpoa Trojan.Win32.Crypt.evvrmx BackDoor.Tordev.976 BehavesLike.Win32.Trojan.fc TR/Dropper.MSIL.lfcge Trojan:Win32/Rebhip.AA!bit Trojan.MSIL.Crypt.fpoa Trj/GdSda.A Msil.Trojan.Crypt.Hfp Trojan.MSIL.Injector MSIL/Injector.LHM!tr Win32/Trojan.658


A backdoor also known as: Infostealer.Jackpos BKDR_JACKPOS.SM BKDR_JACKPOS.SM BehavesLike.Win32.Dropper.ch Trojan.Win32.Jinupd W32/Trojan.RTKE-0140 Trojan:Win32/Jinupd.B Trojan/Win32.HDC.C743594 Trj/JackPos.A Win32/Trojan.2d8


First observed in July 2014, Dridex, a financial banking Trojan, is considered the successor to the GameOver ZeuS GoZ malware.


A backdoor also known as: Backdoor.Sdbot Backdoor/SdBot.zj Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Sdbot.MAM W32.Spybot.Worm Win32/Dopbot.B WORM_SDBOT.CGE Win.Trojan.SdBot-3536 Backdoor.Win32.SdBot.zj Trojan.Win32.SdBot.esce Backdoor.Win32.SdBot.28160.B Backdoor.W32.SdBot.zj!c BackDoor.IRC.Veritas Backdoor.SdBot.Win32.2281 WORM_SDBOT.CGE BehavesLike.Win32.Backdoor.mc Packed.Morphine.a WORM/IrcBot.28160.1 Trojan[Backdoor]/Win32.SdBot Backdoor.Win32.SdBot.zj BScope.Trojan-PSW.Gomex.8 W32/Gaobot.FCZ.worm IRC/SdBot.DWM Win32.Backdoor.Sdbot.Pavs Worm.SdBot!xpvJkAbKgi0


A backdoor also known as: HackTool.MultiUnwrapper Win32.Trojan.WisdomEyes.16070401.9500.9852 Infostealer.Gampass Win.Trojan.736804-1 HackTool.Win32.MultiUnwrapper Trojan[Dropper]/Win32.Dapato Trj/CI.A Riskware.HackTool!LCoXxVEhnjI Win32/Trojan.03f


APT-C-36, also known as Blind Eagle, has been actively targeting organizations in Colombia and Ecuador since at least 2019.


A backdoor also known as: Adware.Rugo Trojan.Win32.BHO.fie AdWare.Win32.BHO.cdg Trojan.MulDrop.15726 TR/BHO.fie TrojanDropper:Win32/Jhee.V Trojan.Win32.BHO.fie Adware.WSearch.O Trojan.Win32.Jhee.V Trojan.BHO.fie


A backdoor also known as: TrojanDownloader.Cabby Trojan/Filecoder.MaktubLocker.c Win32.Trojan.WisdomEyes.16070401.9500.9999 RANSOM_CRYPMAKTUBLOCKER_GC3101B5.UVPM Trojan.Win32.Banpak.bbb Trojan.Win32.Cabby.emrzuq W32.Virut.lyDR Trojan.DownLoader24.13143 Downloader.Cabby.Win32.1871 RANSOM_CRYPMAKTUBLOCKER_GC3101B5.UVPM TrojanDownloader.Cabby.cpa TR/Crypt.Xpack.wgudg Trojan[Downloader]/Win32.Cabby Trojan.Razy.D255EB Trojan.Win32.Ransom.59904.R Trojan.Win32.Banpak.bbb Trojan/Win32.Locky.R197360 TrojanDownloader.Cabby Win32/Filecoder.MaktubLocker.C Trojan.Filecoder!sTyUXy4/Qig


The Sofacy group, also known as APT28, Pawn Storm, Fancy Bear, and Sednit, continues to add to the variety of tools they use in attacks; in this case, targeting individuals in the aerospace industry running the OS X operating system.


A backdoor also known as: Backdoor/W32.Androm.266082.B Trojandownloader.Macdowpay Trojan.Win32.Godzilla.ephbuw Trojan.Encoder.11909 Backdoor.Androm.Win32.43313 BehavesLike.Win32.Backdoor.dc Trojan.Yakes.vjn Trojan.Backdoor.Quakbot TR/Fuery.shpvm TrojanDownloader:Win32/Macdowpay.A Trojan.Razy.D2B7A8 Trojan/Win32.Locky.R201696 Backdoor.Androm Backdoor.Andromeda Trj/CI.A


A backdoor also known as: Trojan.Horst Win32.Trojan.WisdomEyes.16070401.9500.9997 W32/Downloader.OMUB-6519 Trojan-Proxy.Win32.Horst.av Trojan.Win32.Horst.dqlqvp Trojan.DownLoader.9121 W32/Downloader.YSQ Trojan[Proxy]/Win32.Horst Trojan-Proxy.Win32.Horst.av TrojanProxy.Horst


A backdoor also known as: Win32.Trojan-PSW.OLGames.bp W32.Rontokbro@mm Trojan.Win32.Krap.dazptt Trojan.Win32.Z.Onlinegames.25088.A Trojan.Click3.21708 BehavesLike.Win32.PWSOnlineGames.mc W32/Trojan.UITW-4840 Trojan/PSW.OnLineGames2.dg PWS:Win32/Zakahic.A Win32.Trojan.Dropper.Heur Trojan.Win32.OnlineGames.daq Trojan-GameThief.Win32.OnLineGames W32/Onlinegames.PYY!tr


This new threat actor we are naming YoroTrooper has been targeting governments across Eastern Europe since at least June 2022, and Cisco Talos has found three different activity clusters with overlapping infrastructure that are all linked to the same threat actor.


The code contains multiple comments in Italian , here is the most noteworthy example : “ Receive commands from the remote server , here you can set the key commands to command the virus ” Here are the available commands : Name Description cd Change current directory to specified quit Close the socket nggexe Execute received command via Python ’ s subprocess.Popen ( ) without outputs ngguploads Upload specified file to the specified URL nggdownloads Download content from the specified URLs and save to specified file nggfilesystem Dump file structure of the C : path , save it to the file in json format and zip it nggstart_screen nggstop_screen Enable/disable screenshot module .


A backdoor also known as: Win32/SillyPWS.CT Trojan-Spy.MSIL!IK Trojan.MulDrop1.16499 TrojanSpy.MSIL.acx PWS:MSIL/VB.B Trojan-Spy.MSIL


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9994 Trojan.Win32.Waldek.aqji Trojan.Win32.Dwn.dzdxxu BackDoor.PlugX.7 Dropper.Dapato.Win32.27346 BehavesLike.Win32.MultiPlug.fh TrojanDropper.Dapato.snz TR/AD.Plugx.M.6 Trojan[Dropper]/Win32.Dapato Trojan.Win32.Waldek.aqji Backdoor:Win32/Plugx.L!dha Trj/GdSda.A Win32.Trojan.Waldek.Wrgj Trojan.Win32.Crypt W32/Kryptik.DGGW!tr TrojanDropper.Dapato Win32/Trojan.bdb


Unfortunately, malware authors often utilize these same capabilities to compromise systems.


This notable characteristic made this attack worthy of further analysis.


First, this domain pattern looks just like the extremely prevalent, yet benign Akamai CDN domain.


A backdoor also known as: WORM_DORKBOT.SMA Win32.Trojan.WisdomEyes.16070401.9500.9989 Trojan.FakeAV WORM_DORKBOT.SMA Packed.Win32.Katusha.o Trojan.Win32.Katusha.exnjhu BehavesLike.Win32.PWSZbot.qc Packed.Katusha.agmk Trojan.Downloader.126 Packed.Win32.Katusha.o Win32.Worm.Autorun.E Trojan/Win32.Cosmu.C71744 W32/Crypt.AAAI!tr


A backdoor also known as: Udsdangerousobject.Multi Trojan.Waldek.Win32.5328 Uds.Dangerousobject.Multi!c BKDR_REMCOS.DRQW Trojan.Win32.Waldek.akql Trojan.Win32.Waldek.etvwxi Trojan.Win32.Z.Highconfidence.731416 BKDR_REMCOS.DRQW Trojan.Win32.Waldek W32/Trojan.CSQN-6734 W32.Waldek.Akql TR/Waldek.rludr Trojan/Win32.Waldek Trojan:Win32/Vonocksu.A Trojan.Win32.Waldek.akql Trojan/Win32.Waldek.C2216962 Trj/GdSda.A Win32.Trojan.Waldek.Htvv W32/REMCOS.DRQW!tr.bdr


Unlike other ATM malware families, Alice cannot be controlled via the numeric pad of ATMs; neither does it have information stealing features.


A backdoor also known as: Trojan.Win32.Malware.1 W32.Mailbancos@mm Win32.Mailbancos@mm W32.Mailbancos@mm SHeur2.XWF Trj/Banbra.GGU


A backdoor also known as: HW32.Packed.A13D Backdoor.Sinowal.BC Backdoor/W32.Sinowal.335872.B Backdoor.Sinowal.Win32.471 Backdoor.Sinowal.BC Win32.Trojan.WisdomEyes.16070401.9500.9996 Trojan.Mebroot Win.Trojan.Sinowal-1209 Backdoor.Sinowal.BC Backdoor.Win32.Sinowal.eee Backdoor.Sinowal.BC Trojan.Win32.Sinowal.bfkka Backdoor.Win32.Sinowal.335872 Backdoor.W32.Sinowal!c Backdoor.Sinowal.BC Backdoor.Win32.Sinowal.~CRSB Trojan.Packed.2355 BehavesLike.Win32.Sality.fc Backdoor.Win32.Sinowal W32/Backdoor2.EHUE Backdoor/Sinowal.gje RKIT/MBR.Sinowal.W Trojan[Backdoor]/Win32.Sinowal Win32.Hack.SinowalT.bg.339968 Backdoor.Win32.Sinowal.eee Backdoor.Sinowal.BC Backdoor.Sinowal Win32.Backdoor.Sinowal.Liqd W32/SINOWAL.A!tr


What makes this interesting is how the dated botnet and macro malware trick are used together.


This weekend saw multiple reports a new zero-day vulnerability that affected all versions of Microsoft Word.


A 17-year-old vulnerability in Microsoft Office Equation Editor is now confirmed to be exploited by the Cobalt Group.


In recent months, Kaspersky observed an increase in the number of malicious campaigns that use Google Advertising as a means of distributing and delivering malware.


A backdoor also known as: TROJ_BHO.SMK Win32.Trojan.WisdomEyes.16070401.9500.9922 W32/MalwareS.AXKH TROJ_BHO.SMK Trojan.DownLoader7.50629 BehavesLike.Win32.PWSZbot.dm Backdoor.WinNT.PcClient W32/Risk.AWDS-7973


Initially, only the Windows version of ROKRAT was used, but the Android version of the malware was later identified.


A backdoor also known as: HW32.Packed.F73E Backdoor/W32.Xhaker.593920 Backdoor.Xhaker.b.n7 Backdoor.Xhaker.Win32.49 Backdoor/Xhaker.b Trojan.Win32.Xhaker.cbfde W32/BackdoorX.BNHA Backdoor.Trojan Smalldoor.BKPC Backdoor.Win32.Xhaker.b Backdoor.Xhaker!qYrnZt9Kncc PE:Backdoor.Win32.VB.bnx!1075029071 BackDoor.Caverns.79 BehavesLike.Win32.Ramnit.hc W32/Backdoor.IYKC-7331 Backdoor/Xhaker.l Win32.Hack.Xhaker.b.kcloud Win32.Backdoor.Xhaker.doln W32/Xhaker.B!tr.bdr Backdoor.Win32.Xhaker.b Win32/Backdoor.bee


We recently uncovered a coordinated campaign targeting Internet infrastructure providers, a media organization, a financial services company, and an Asian government organization.