📊 2023 OpenText Cybersecurity Threat Report
A database of major known threats as seen by Webroot and other security channels.
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34512i2DEB8EFA2B8AE49D.png[/img] [i]May 18th, 2018 By Justin Pot [url=https://www.howtogeek.com/fyi/how-to-remove-mshelper-the-latest-mac-malware/]How-To Geek[/url][/i] [u][b]Summary[/b][/u][b] - [/b]It is unknown what exactly mshelper is doing to utilize the processor at such a high rate, but speculation on the Apple support forum suggests it could be some form of [url=https://www.webroot.com/us/en/resources/glossary/what-is-adware]adware[/url], or possibly a program used for mining cryptocurrency on a victim’s computer. Aside from using the processor, there also doesn’t seem to be any other issues it causes on affected desktops. Whatever the application is up to, you don’t want it. Remove it as soon as you notice it. [b][u]Article Link[/u] - [url=https://www.scmagazine.com/fbi-dhs-report-details-new-north-korean-trojan/article/773825/]Read more[/url][/b] [url=https://www.webroot.
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34547i47E7F297718FEA15.png[/img] [u][b]Summary[/b][/u][b] - [/b]There's a new form of malware on the Web that is stealing card information from browsers (among other things) and we've had a few people reach out and ask if they are protected. So to answer that question, yes, so long as you have Webroot installed, we have you covered. [b][u]Article Link[/u] - [url=https://www.proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware Manifesto[/url]
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34532i99695B9867882953.png[/img] [i]23rd May, 2018 By Lawrence Abrams [url=https://www.bleepingcomputer.com/news/security/crypton-ransomware-installed-using-hacked-remote-desktop-services/]Bleeping Computer[/url][/i] [u][b]Summary[/b][/u][b] - [/b]A new and active campaign for the CryptON [url=https://www.webroot.com/us/en/resources/glossary/what-is-ransomware]Ransomware[/url] is currently underway where attackers are hacking into computers with Internet accessible Remote Desktop Services. Once the attackers gain access to the computer they manually execute the ransomware and encrypt your files. This new campaign was first discovered by Malwarebytes security researcher S!Ri who posted about it on Twitter. [b][u]Article Link[/u] - [url=https://www.bleepingcomputer.com/news/security/crypton-ransomware-installed-using-hacked-remote-desktop-services/]Read more[/url][/b]
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34533i6EFF4E93D3A95A11.png[/img] [u][b]Summary[/b][/u][b] - [/b]The very first variants of Cryptolocker ransomware came out in late September 2013. The idea behind it stemmed directly from the FBI Moneypak/Ukash scams that would lock your computer right before you could log into windows and demand ransom to get back into the computer. Except with this family of malware, your files were locked away through [url=https://www.webroot.com/us/en/resources/glossary/what-is-encryption]encryption[/url] and victims had to pay the ransom to get their files back. The big difference was that you couldn't fix this malware by taking it to a computer technician as there was no way for technicians to decypt the files - you had to pay the ransom. It was an instant success as far as criminal business models go, and soon there were many variants of ransomware infecting users around the world. Early edit
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34548i9B34CCD0A533A08F.png[/img] [i]23rd May, 2018 By William Largent [url=https://blog.talosintelligence.com/2018/05/VPNFilter.html]Talos Intelligence[/url][/i] [u][b]Summary[/b][/u][b] - [/b]For several months, Talos has been working with public- and private-sector threat intelligence partners and law enforcement in researching an advanced, likely state-sponsored or state-affiliated actor's widespread use of a sophisticated modular malware system we call "VPNFilter." We have not completed our research, but recent events have convinced us that the correct way forward is to now share our findings so that affected parties can take the appropriate action to defend themselves. In particular, the code of this malware overlaps with versions of the BlackEnergy malware — which was responsible for multiple large-scale attacks that targeted devices in Ukraine. While this isn't definitive by any means, we h
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34530i44349F11782C3B32.png[/img] [i]25th May, 2018 By Catalin Cimpanu [url=https://www.bleepingcomputer.com/news/security/backswap-banking-trojan-uses-never-before-seen-techniques/]Bleeping Computer[/url][/i] [u][b]Summary[/b][/u][b] - [/b]Security researchers have discovered a new banking trojan named BackSwap that uses never-before-seen techniques to facilitate the theft of online funds. The techniques the trojan uses have not been observed with another malware family, and they can bypass antivirus software detection and security protections put in place at the browser level. Experts believe these techniques will soon be copied by other groups and spread around to trigger a new wave of banking trojan attacks right when infections with this malware type have begun to go down. [b][u]Article Link[/u] - [url=https://www.bleepingcomputer.com/news/security/backswap-banking-tro
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34549i1DAE5050D7ACF74E.png[/img] [i]28th May, 2018 By Pierluigi Paganini [url=https://securityaffairs.co/wordpress/72977/malware/malhide-malware-analysis.html]Security Affairs[/url][/i] [h3][u][b]Summary[/b][/u][b] - [/b]The cybersecurity experts Marco Ramilli analyzed a new sample of malware dubbed MalHide that implements a quite new attack path to use the compromised system as eMail relay in order to hide the attacker networks. [/h3][h3]I believe this is a quite interesting Malware because it firstly implements several obfuscation stages by using different obfuscation techniques and secondly it implements a quite new attack path (not new per-se but new on opportunistic malware families) where the attacker doesn’t want to steal information and/or compromise a system for possession and/or destruction but the attacker uses the compromised system as eMail relay in order to hide the atta
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34529iBF6402E441FC63F5.png[/img] [i]29th May, 2018 By Ionut Arghire [url=https://www.securityweek.com/new-trojan-uses-sql-server-cc]Security Week[/url][/i] [u][b]Summary[/b][/u][b] - [/b]A recently discovered banking Trojan leverages Microsoft SQL Server for communication with the command and control (C&C), IBM has discovered. Dubbed MnuBot, the malware uses the database server for communication with the bot and to send commands to the infected machines. The Trojan features two components, each in charge of a different phase of a two-stage attack flow. [b][u]Article Link[/u] - [url=https://www.securityweek.com/new-trojan-uses-sql-server-cc]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Archive_KB]Back to the Malware
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34525i8532E5BEAA90AB16.png[/img] [i]30th May, 2018 By Eduard Kovacs [url=https://www.securityweek.com/us-attributes-two-more-malware-families-north-korea]Security Week[/url][/i] [u][b]Summary[/b][/u][b] - [/b]The U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have issued another joint technical alert on the North Korea-linked threat group known as Hidden Cobra. The latest alert attributes the Joanap backdoor trojan and the Brambul worm to the North Korean government. It provides IP addresses and other indicators of compromise (IoC) associated with these threats in an effort to help organizations protect their networks against attacks. [b][u]Article Link[/u] - [url=https://www.securityweek.com/us-attributes-two-more-malware-families-north-korea]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glos
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34521i54B4861E24FD794F.png[/img] [i]30th May, 2018 By Eduard Kovacs [url=https://www.securityweek.com/us-attributes-two-more-malware-families-north-korea]Security Week[/url][/i] [u][b]Summary[/b][/u][b] - [/b]The U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have issued another joint technical alert on the North Korea-linked threat group known as Hidden Cobra. The latest alert attributes the Joanap backdoor trojan and the Brambul worm to the North Korean government. It provides IP addresses and other indicators of compromise (IoC) associated with these threats in an effort to help organizations protect their networks against attacks. [b][u]Article Link[/u] - [url=https://www.securityweek.com/us-attributes-two-more-malware-families-north-korea]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glossary]Glo
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34550i758931F85D56D295.png[/img] [i]31st May, 2018 By Tara Seals [url=https://threatpost.com/nocturnal-stealer-lets-low-skilled-cybercrooks-harvest-sensitive-info/132422/]Threat Post[/url][/i] [u][b]Summary[/b][/u][b] - [/b]The Nocturnal Stealer malware has crept into the Dark Web like a thief in the night, offering criminals a lucrative payday for a small price — and little effort. It’s a commodity malware, debuting on an underground forum in March for the low price of $25. It steals things, including 28 different kinds of cryptocurrency wallets, saved FTP passwords within FileZilla, and Chrome and Firefox browser information (such as login credentials, cookies, web data, autofill data and stored credit cards). It also zips up system data, including IP address and language, machine ID, date/time, installation location, operating system, architecture, username, processor type, video card inf
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34528i4A7B56419052FE81.png[/img] [i]25th May, 2018 By Vishal Thakur [url=https://blog.malwarebytes.com/threat-analysis/2018/05/malware-analysis-decoding-emotet-part-1/]MalwareBytes Labs[/url][/i] [u][b]Summary[/b][/u][b] - [/b]Emotet Banking Trojan malware has been around for quite some time now. As such, infosec researchers have made several attempts to develop tools to de-obfuscate and even decrypt the AES-encrypted code belonging to this malware. The problem with these tools is that they target active versions of the malware. They run into problems when the authors of the malware change the code. The change could be anything from slight variations to the code structure to drastic changes such as moving from a VBA project to PowerShell scripting. Usually, even a minor code variation breaks the tools. [b][u]Article Link[/u] - [url=https://blog.malwarebytes.com/threat-analys
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34868iACFA8173A7F31EE5.png[/img] [i]1st June, 2018 By John Leyden [url=http://www.theregister.co.uk/2018/06/01/mirai_respun_in_new_botnets/]The Register[/url][/i] [u][b]Summary[/b][/u][b] - [/b]Cybercrooks are using the infamous Mirai IoT botnet as a framework to quickly add in new exploits and functionalities, it has emerged. The tactic is dramatically decreasing the development time for new botnets, according to research from Netscout's Arbor Security Engineering and Response Team (ASERT). The work looks at four Mirai variants – Satori, JenX, OMG and Wicked – to illustrate how their authors have built upon Mirai and added their own flair. [b][u]Article Link[/u] - [url=http://www.theregister.co.uk/2018/06/01/mirai_respun_in_new_botnets/]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url]
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34527iFC96B3452078CA6E.png[/img] [i]31st May, 2018 By Anonymous [url=https://www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0]Proofpoint Staff[/url][/i] [u][b]Summary[/b][/u][b] - [/b]2018 has seen a marked shift away from high-volume, immediately destructive [url=https://www.webroot.com/us/en/resources/glossary/what-is-ransomware]ransomware[/url] campaigns to distribution of banking Trojans, information stealers, and downloaders. Banking Trojans now make up almost 60% of malicious payloads we observe in email. Now a new banking Trojan has emerged, adding to the growing diversity of this segment specifically and malicious email campaigns in general. Proofpoint researchers discovered a new banking Trojan, dubbed “DanaBot”, targeting users in Australia via emails containing malicious URLs. Written in Delphi, the malware is still under active
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34524iC944F9F019CDFBDD.png[/img] [i]6th June, 2018 By Ionut Arghire [url=https://www.securityweek.com/backdoor-uses-socketio-bi-directional-communication]Security Week[/url][/i] [u][b]Summary[/b][/u][b] - [/b]A recently discovered remote access Trojan is using a specialized program library that allows operators to interact with the infected machines directly, without an initial “beacon” message, G Data reports. Dubbed SocketPlayer, the backdoor stands out because it doesn’t use the typical one-way communication system that most banking Trojans, backdoors, and [url=https://www.webroot.com/us/en/resources/glossary/what-is-a-keylogger]keyloggers[/url] use. Instead, it employs the socket.io library, which enables real-time, bi-directional communication between applications. [b][u]Article Link[/u] - [url=https://www.securityweek.com/backdoor-uses-socketio-bi-directional-commun
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34535i6C5AB60DBA914C3B.png[/img] [i]6th June, 2018 By Anonymous [url=https://bartblaze.blogspot.com/2018/06/redeye-ransomware-theres-more-than.html]Blaze's Security Blog[/url][/i] [u][b]Summary[/b][/u][b] - [/b]A rather anonymous account reached out to me on Twitter asking to check out a "scary & really nasty" sample. It turned out to be RedEye [url=https://www.webroot.com/us/en/resources/glossary/what-is-ransomware]ransomware[/url], a new strain or variant by the same creator of Annabelle ransomware, which I discovered in February earlier this year. [b][u]Article Link[/u] - [url=https://bartblaze.blogspot.com/2018/06/redeye-ransomware-theres-more-than.html]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.webroot.com/t5/Malware-Manifesto/tkb-p/Malware_Ar
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34556i19B81D7BC8AB20B6.png[/img] [i]7th June, 2018 By Catalin Cimpanu [url=https://www.bleepingcomputer.com/news/security/lol-babayaga-wordpress-malware-updates-your-site/]Bleeping Computer[/url][/i] [u][b]Summary[/b][/u][b] - [/b]Security researchers have spotted a malware strain targeting WordPress sites that includes some pretty clever self-preservation techniques, such as removing competing malware and updating the victim's site. Named BabaYaga, this malware strain isn't new, but recent updates have transformed this former low-key player into a considerable foe for WordPress site administrators. [b][u]Article Link[/u] - [url=https://www.bleepingcomputer.com/news/security/lol-babayaga-wordpress-malware-updates-your-site/]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=https://www.webroot.com/blog/]Blog[/url] [url=https://community.
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34555i208188F4E02D08F4.png[/img] [i]8th June, 2018 By Ionut Arghire [url=https://www.securityweek.com/new-killdisk-variant-hits-latin-america]Security Week[/url][/i] [u][b]Summary[/b][/u][b] - [/b]A new version of the destructive KillDisk malware was observed earlier this year targeting organizations in Latin America, Trend Micro reports. KillDisk has been around for several years, and was used in attacks targeting Ukraine’s energy sector in 2015, orchestrated by the Russia-linked threat actor BlackEnergy. Initially designed to wipe hard drives and render systems inoperable, the malware received file-encrypting capabilities in late 2016, with a Linux-targeting variant of the [url=https://www.webroot.com/us/en/resources/glossary/what-is-ransomware]ransomware[/url] spotted shortly after. [b][u]Article Link[/u] - [url=https://www.securityweek.com/new-killdisk-va
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34554i02EFA445626CE241.png[/img] [i]June 8, 2018 By Pierluigi Paganini [url=https://securityaffairs.co/wordpress/73328/malware/dmosk-malware-hits-italy.html]Security Affairs[/url][/i] [h2][u][b]Summary[/b][/u][b] - [/b]The security expert and malware researcher Marco Ramilli published a detailed analysis on a new strain of malware dubbed DMOSK that targets Italian firms. Today I’d like to share another interesting analysis made by my colleagues and I. It would be a nice and interesting analysis since it targeted many Italian and European companies. Fortunately, the attacker forgot the LOG.TXT freely available on the dropping URL letting us know the IP addresses who clicked on the first stage analyzed stage (yes, we know the companies who might be infected). Despite what we did with TaxOlolo we will not disclose the victims IP addresses and so the companies wh
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34522i869E6A7A3EE93DE4.png[/img] [i]8th June, 2018 By Catalin Cimpanu [url=https://www.bleepingcomputer.com/news/security/invisimole-is-a-complex-spyware-that-can-take-pictures-and-record-audio/]Bleeping Computer[/url][/i][url=https://www.bleepingcomputer.com/news/security/invisimole-is-a-complex-spyware-that-can-take-pictures-and-record-audio/] [/url] [u][b]Summary[/b][/u][b] - [/b]Security researchers from ESET have discovered a complex piece of spyware that was used sparingly in the last five years to infect and spy on a very small number of targets in Russia and Ukraine. While the origin of this new malware strain —named InvisiMole— have not been determined yet, it is believed that this is an advanced cyber-espionage tool, most likely created for nation-state or financially-motivated hacks. This assessment is based on the fact that the malware has been seen very rarely, being foun
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34515i797A0DBB33F6BBBF.png[/img] [i]June 12th, 2018 By Ionut Arghire [url=https://www.securityweek.com/new-pyromineiot-malware-spreads-nsa-linked-exploit]Security Week[/url][/i] [u][b]Summary[/b][/u][b] - [/b]A recently discovered piece of crypto-currency miner malware isn’t only abusing a National Security Agency-linked remote code execution exploit to spread, but also abuses infected machines to scan for vulnerable Internet of Things (IoT) devices. Dubbed PyRoMineIoT, the malware is similar to the PyRoMine crypto-currency miner that was detailed in late April. Both mine for Monero, both are Python-based, and both use the EternalRomance exploit for propagation purposes (the vulnerability was patched in April last year). [b][u]Article Link[/u] - [url=https://www.securityweek.com/new-pyromineiot-malware-spreads-nsa-linked-exploit]Read more[/url][
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34514i2355C74336B98A62.png[/img] [i]12th June, 2018 By Chris Smith [url=http://bgr.com/2018/06/12/android-crypto-malware-amazon-fire-tv-stick/]BGR[/url][/i] [u][b]Summary[/b][/u][b] - [/b]Be careful what you side-load on your Amazon Fire TV and Fire TV Stick, as there’s a new strain of malware going around that can affect Amazon’s products even though the app isn’t exactly tailored for these devices. The purpose of the virus app called ADB.Miner is quite simple: to turn gadgets into cryptocurrency miners. I’m sure you’ve heard of this type of malware before, as it targets plenty of other platforms. But yes, it’s 2018, and your TV can get a virus now, because we live in the future. [b][u]Article Link[/u] - [url=http://bgr.com/2018/06/12/android-crypto-malware-amazon-fire-tv-stick/]Read more[/url][/b] [url=https://www.webroot.com/us/en/resources/glossary]Glossary[/url] [url=
[img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/34534i466137D9F6DA600E.png[/img] [i]28th February, 2018 By Tomas Meskauskas [url=https://www.pcrisk.com/removal-guides/12212-gandcrab-ransomware]PCrisk[/url][/i] [u][b]Summary[/b][/u][b] - [/b]GANDCRAB is another [url=https://www.webroot.com/us/en/resources/glossary/what-is-ransomware]ransomware[/url]-type virus distributed using RigEK toolkit. Once infiltrated, encrypts most stored data and adds the ".GDCB" extension to the name of each compromised file. From this point, files become unusable. Immediately after [url=https://www.webroot.com/us/en/resources/glossary/what-is-encryption]encryption[/url], GANDCRAB generates a "GDCB-DECRYPT.txt" file and places a copy in every existing folder. The new text file contains information regarding the current situation and instructs victims what to do next. To decrypt data, victims must open a Tor web page and follow the instructions within. The we
