CATEGORY ARCHIVES: threatstop-research-team

Locky Back in Action

Locky, the infamous ransomware plaguing computers worldwide since it was first seen early last year, has recently made a comeback after a severe drop in activity over the holiday season. The Necurs botnet, which is Locky's primary distributor, was offline for the final weeks of 2016, equating to an 81% decrease in the number of Locky attacks.

Share this:

CryptXXX Ransomware Spread Through SoakSoak Botnet: Two Big Actors As One

CryptXXX and SoakSoak are huge threats individually.

Share this:

One Email: Countless Phishing Domains

We often analyze indictors of phishing-related compromise from techhelplist.com. These lists contain a large number of indicators, usually not all related to one campaign, but to countless ones that have already spread before the lists were updated.

Share this:

DGA Updates

wood-cube-473703_1280.jpg

In December, we introduced a target list of more than 20 malware family DGAs provided by our friends over at 360 Research Team. Continuing their great work, we are happy to integrate 7 new malware DGAs:

Share this:

The “TelePort Crew” Evolves from Carbanak

The "Digital Plagiarist" campaign, dubbed by researchers at the tr1adx team, was run by the "TelePort Crew” and appears to be an evolution of the Carbanak cybercrime group. This group is infamous for a large-scale campaign against banks, leading to the 2015 theft of hundreds of millions of dollars and the Carbanak/Anunak malware that targets point of sale machines.

Share this:

Switcher Android Malware - The Road From Android App to Hijacking DNS Server

One of the most recent campaigns highlighting the importance of router security is Mirai (The botnet that had large scale attacks by infected IoT devices). Even before this, reports emphasized the importance and vulnerability of these devices. For example, Report by Malware Researcher Kafeine revealed the use of an exploit kit aimed to exploit routers. This method showed Google Chrome users were redirected to a malicious server that loaded code designed to determine router models. (While changing the DNS servers configured to the router)

Share this:

Operation Emmental\SmsSecurity

The evolving threats targeted at mobile devices and the increasing number of campaigns targeted at financial institutions have joined forces and become a double threat in what have become known as the  The Emmental campaign. 

Share this:

ThreatSTOP security team is proud to present - Banking Malware Targets

Banking Malware steals millions of dollars from both personal and business accounts in the United States every year. Personal accounts are insured by federal banking regulations, but businesses are less protected.

Share this:

Nemucod spreads through Facebook messages

Share this:

Gooligan- The recent Hooligan that is spreading

One criteria for the success of malware is its scope of distribution. Gooligan, a mobile malware, found in the app SnapPea that is described as a "one-stop shopping experience", has succeeded in this aspect. Check Point reported that this malware has breached more than 1 Million Google accounts. This malware has been distributed through apps that are available in third party Android stores. In order to increase the number of downloads for these apps, and in turn the malware, there have also been phishing campaigns which contained download links, sent through various messaging services.

Share this: