Tag: Cybercrime
Figure 2: Weblogic WLS-WSAT campaign attempting to download and execute the same Windows executable file This attempt to download the same file immediately indicated to us that the same attacker was using different exploits in the operation. Unfortunately, these files weren’t available to download from the original server nor from other malware repositories, so…
Read MoreFigure 14: Statistics of the Monero mining payment address belonging to the attacker The attacker has earned 8.76 Monero coins by now,4 with a current price of 110.79 USD per a Monero coin,5 which totals to 970.52 USD. According to the information provided on the mining server website, this operation began around June 1.…
Read MoreBackSwap is new banking malware recently discovered by Eset1 and later analyzed by CERT Polska.2 Unlike previous banking trojans, which typically either intercept requests and redirect users to fake banking websites or inject malicious code from command and control (C&C) servers to manipulate browser processes, BackSwap keeps its campaign locally. The JavaScript is hardcoded and…
Read MoreThreat actors continue to find creative yet relatively unsophisticated ways to launch new campaigns to reap profits from crypto-mining operations. Source link lol
Read MoreNote that each “while” loop is performing string decryption on the sequences of bytes shown in the variables above the loop. When following the execution in a debugger, the strings are decrypted, and some meaningful indicators of VM checks are visible. (See appendix for decryption function details.) In this code snippet, three checks are evident:…
Read MoreYou might have been scammed without even knowing it. A 2016 NYU study1 found that many scammers used affiliate programs from background check companies to earn a commission every time they referred someone to the program. So, let’s say you found a rental you were interested in on Craigslist and you emailed the owner. The…
Read MoreJust two weeks ago a new Apache Struts 2 critical remote code execution vulnerability was published,1 and F5 researchers have already detected known threat actors exploiting it in a new crypto-mining campaign: CVE-2018-11776 Apache Struts 2 namespace vulnerability allows unauthenticated remote code execution. In this Monero crypto-mining campaign, the injection point is within the URL.…
Read MoreFigure 4: Dynamically resolving Windows API functions In conclusion, sometimes changes, even minor ones such as this one, are enough to break a working automation process, and they require some time to investigate. That’s how the malware’s authors gain precious time to defraud unsuspecting victims before security vendors can denylist their servers. As a reminder,…
Read MoreF5 Labs continually tracks DDoS trends based on data from various sources. Among the most important are the F5 Security Operations Center (SOC), the front line for mitigating DDoS attacks on behalf of F5 Silverline customers, and F5’s Security Incident Response Team (SIRT), which assists F5 customers who are under attack. This article is a…
Read MoreThe number of Mirai scanner systems across the world decreased slightly from December 2017 to June 2018. There is less concentration of scanner systems in North America, South America, and Asia in June 2018 versus December 2017. Europe is the only region where Mirai scanner infections remained relatively the same from December 2017 to June…
Read More