Author Archives:threatstopvt

Recent Posts

Magic Hound Sniffs Out Trouble

 

Magic Hound, as dubbed by researchers at Palo Alto Networks, is a targeted espionage campaign against Saudi Arabian government, energy and technology industries. The campaign utilized a common phishing tactic, embedding macros into Word and Excel documents. If the victim enabled macros on the document, Powershell scripts downloaded additional malware onto their computer, such as the open-source Python RAT, Pupy.

Read More

Share this:

Locky Back in Action

Locky, the infamous ransomware plaguing computers worldwide since it was first seen early last year, has recently made a comeback after a severe drop in activity over the holiday season. The Necurs botnet, which is Locky's primary distributor, was offline for the final weeks of 2016, equating to an 81% decrease in the number of Locky attacks.

Read More

Share this:

The “TelePort Crew” Evolves from Carbanak

The "Digital Plagiarist" campaign, dubbed by researchers at the tr1adx team, was run by the "TelePort Crew” and appears to be an evolution of the Carbanak cybercrime group. This group is infamous for a large-scale campaign against banks, leading to the 2015 theft of hundreds of millions of dollars and the Carbanak/Anunak malware that targets point of sale machines.

Read More

Share this:

Nemucod spreads through Facebook messages

Read More

Share this:

ANDROID MALWARE MARCHES AWAY WITH BANKING CREDENTIALS

Marcher is an evolving Android-based banking Trojan, changing in scope and capabilities since first seen in 2013. Spreading through phishing emails and websites, it prompts the victim to download “security updates” from third party app stores. It has also been found to spread through malicious apps on the Google Play Store itself.

Read More

Share this:

Don’t Pony Up Your Data to Fareit

Fareit, also known as Pony, is a data stealing Trojan that can decrypt or unlock passwords for over 110 different applications, including VPN, FTP, email, instant messaging, web browsers and much more. It is also capable of stealing a victim’s bitcoin wallets. Once it has collected its victim's data, Fareit uploads these stolen credentials to a remote Command and Control (C2) server the criminal has access to. Fareit is very dangerous because its infection on a computer can make the device part of a botnet, allowing the malware to use it to infect other devices.

Read More

Share this: