BUGS

Hermes ransomware distributed to South Koreans via recent Flash zero-day

Hermes ransomware distributed to South Koreans via recent Flash zero-day

March 14, 2018

This blog post was authored by @hasherezade, Jérôme Segura and Vasilios Hioureas. At the end of January, the South Korean Emergency…

RIG malvertising campaign uses cryptocurrency theme as decoy

RIG malvertising campaign uses cryptocurrency theme as decoy

February 28, 2018

For a couple of weeks, we have been observing a malvertising campaign that uses decoy websites to redirect users to the…

GandCrab ransomware distributed by RIG and GrandSoft exploit kits (updated)

GandCrab ransomware distributed by RIG and GrandSoft exploit kits (updated)

January 30, 2018

This post was authored by Vasilios Hioueras and Jérôme Segura Update (2018-04-16): Magnitude EK has switched from Magniber to GandCrab. Update (2018-02-28): Major…

RIG exploit kit campaign gets deep into crypto craze

RIG exploit kit campaign gets deep into crypto craze

January 9, 2018

There isn’t a day that goes by without a headline about yet another massive spike in Bitcoin valuation, or a story…

Seamless campaign serves RIG EK via Punycode (updated)

Seamless campaign serves RIG EK via Punycode (updated)

December 4, 2017

Update (2017-12-05): We noted some malvertising chains using a new domain name (newadultthem[.]info) also hosted on the same IP address as…

Terror exploit kit goes HTTPS all the way

Terror exploit kit goes HTTPS all the way

November 27, 2017

We’ve been following the Terror exploit kit during the past few months and observed notable changes in both its redirection mechanism…

A look into the global drive-by cryptocurrency mining phenomenon

Disdain exploit kit and a side of social engineering deliver Neutrino Bot

November 9, 2017

Today we picked up new activity from an exploit kit that was first discovered back in August of this year. The…

Old MS Office feature weaponized in malspam attacks

Old MS Office feature weaponized in malspam attacks

October 17, 2017

Update (11-08-2017): Microsoft has issued a security advisory about DDE-based attacks and is also providing tips on how to disable that…

Decoy Microsoft Word document delivers malware through a RAT

Decoy Microsoft Word document delivers malware through a RAT

October 13, 2017

In this post, we take a look at a Microsoft Word document which itself is somewhat clean, but is used to…