BUGS

Magnitude exploit kit switches to GandCrab ransomware

April 17, 2018

The GandCrab ransomware is reaching far and wide via malspam, social engineering schemes, and exploit kit campaigns. On April 16, we…

Another Day, Another PUP

Exploit kits: Winter 2018 review

March 29, 2018

In the past, we used to do a blog series on exploit kits where we would periodically check in on the…

Hermes ransomware distributed to South Koreans via recent Flash zero-day

Hermes ransomware distributed to South Koreans via recent Flash zero-day

March 14, 2018

This blog post was authored by @hasherezade, Jérôme Segura and Vasilios Hioureas. At the end of January, the South Korean Emergency…

RIG malvertising campaign uses cryptocurrency theme as decoy

RIG malvertising campaign uses cryptocurrency theme as decoy

February 28, 2018

For a couple of weeks, we have been observing a malvertising campaign that uses decoy websites to redirect users to the…

GandCrab ransomware distributed by RIG and GrandSoft exploit kits (updated)

GandCrab ransomware distributed by RIG and GrandSoft exploit kits (updated)

January 30, 2018

This post was authored by Vasilios Hioueras and Jérôme Segura Update (2018-04-16): Magnitude EK has switched from Magniber to GandCrab. Update (2018-02-28): Major…

Seamless campaign serves RIG EK via Punycode (updated)

Seamless campaign serves RIG EK via Punycode (updated)

December 4, 2017

Update (2017-12-05): We noted some malvertising chains using a new domain name (newadultthem[.]info) also hosted on the same IP address as…

Terror exploit kit goes HTTPS all the way

Terror exploit kit goes HTTPS all the way

November 27, 2017

We’ve been following the Terror exploit kit during the past few months and observed notable changes in both its redirection mechanism…

A look into the global drive-by cryptocurrency mining phenomenon

Disdain exploit kit and a side of social engineering deliver Neutrino Bot

November 9, 2017

Today we picked up new activity from an exploit kit that was first discovered back in August of this year. The…

Decoy Microsoft Word document delivers malware through a RAT

Decoy Microsoft Word document delivers malware through a RAT

October 13, 2017

In this post, we take a look at a Microsoft Word document which itself is somewhat clean, but is used to…