Author Archives:akaploun

Recent Posts

EITest – The Long Living Campaign

EITest is a campaign initially discovered in 2014 by Malwarebytes. It distributes malware (that uses iframes) through a flash file on a compromised site, followed by exploitation through an Exploit Kit. In the past, this campaign was used to distribute malware including Cerber, CryptoMix, CryptoShield, Gootkit and the Chthonic banking Trojan, all using various types of Exploit Kits.

Read More

Share this:

CryptXXX Ransomware Spread Through SoakSoak Botnet: Two Big Actors As One

CryptXXX and SoakSoak are huge threats individually.

Read More

Share this:

One Email: Countless Phishing Domains

We often analyze indictors of phishing-related compromise from techhelplist.com. These lists contain a large number of indicators, usually not all related to one campaign, but to countless ones that have already spread before the lists were updated.

Read More

Share this:

Switcher Android Malware - The Road From Android App to Hijacking DNS Server

One of the most recent campaigns highlighting the importance of router security is Mirai (The botnet that had large scale attacks by infected IoT devices). Even before this, reports emphasized the importance and vulnerability of these devices. For example, Report by Malware Researcher Kafeine revealed the use of an exploit kit aimed to exploit routers. This method showed Google Chrome users were redirected to a malicious server that loaded code designed to determine router models. (While changing the DNS servers configured to the router)

Read More

Share this:

Operation Emmental\SmsSecurity

The evolving threats targeted at mobile devices and the increasing number of campaigns targeted at financial institutions have joined forces and become a double threat in what have become known as the  The Emmental campaign. 

Read More

Share this:

Gooligan- The recent Hooligan that is spreading

One criteria for the success of malware is its scope of distribution. Gooligan, a mobile malware, found in the app SnapPea that is described as a "one-stop shopping experience", has succeeded in this aspect. Check Point reported that this malware has breached more than 1 Million Google accounts. This malware has been distributed through apps that are available in third party Android stores. In order to increase the number of downloads for these apps, and in turn the malware, there have also been phishing campaigns which contained download links, sent through various messaging services.

Read More

Share this:

Houdini's RAT Is No Disappearing Act

Most creators of Trojans or worms only known attribution to their creation is made by security researchers, and although, these individuals are not known in person, some of them are known and active in the cybercriminal scene. One of these “celebrity cyber criminals” is known by his alias Houdini, and according to Threatgeek.com is named 'Mohamed Benabdellah'. Houdini is believed to be based in  Algeria and connected to njq8” (aka ‘Naser Al Mutairi’) the developer of other RATs as "njRAT" and "njw0rm".

Read More

Share this:

“Book of Eli” malware

Africa-me.com and afkinsider.com recently reported that several African countries are amongst the most targeted countries by malware attacks and cyber criminals. One can speculate that these attack trends are motivated by relatively low user awareness to cyber security practices in these regions.

Read More

Share this:

New threat, old malware

After the recent major DDoS attacks on large entities such as KrebsOnSecurity and DYN by the Mirai botnet, a known threat on IoT devices, IRCTelnet, has returned and is a big concern for both users and researchers alike as it could prove to be just as far-reaching as the recent DDoS attacks.

Read More

Share this: