Custom Search

South Korean ‘Whois Team’ attacks

Earlier today, reports of a number of cyberattacks against various South Korean targets hit the news.

The attackers, going by the handle “Whois Team” left a number of messages during the defacements:

The code used for defacement, posted by an anonymous user to the “pygments.org” forum (see http://pygments.org/demo/68313/) indicates several e-mails used by the …

Hello from Malaysia

In mid-February 2013 a Kaspersky user from Malaysia asked us to check a Google Play application called My HRMIS & JPA Demo developed by Nur Nazri.

The user was suspicious about the large number of permissions required by the app, though its only stated function was to open four websites.

New Uyghur and Tibetan Themed Attacks Using PDF Exploits

On Feb 12th 2013, FireEye announced the discovery of an Adobe Reader 0-day exploit which is used to drop a previously unknown, advanced piece of malware. We called this new malware “ItaDuke” because it reminded us of Duqu and because of the ancient Italian comments in the shellcode copied from Dante Alighieri’s “Divine Comedy”.

Previously, …

Brazilian Masquerade

What do you see here?

A free AV product protecting a Windows XP machine, right? No, actually it?s malware ? a Brazilian Trojan banker coming via email and then using a masquerade to stay in the system. The malware is 386Kb only, written in Delphi, and comes via an email together with a bunch of …

QUARIAN Attacks Expand Their Targets

During the first half of the year, we have seen targeted attacks leveraging the Syrian conflict and how the backdoor RAT DarkComet was used, which we documented in the following blog posts:

DarkComet Surfaced in the Targeted Attacks in Syrian Conflict Fake Skype Encryption Software Cloaks DarkComet Trojan

After the report that the Anonymous collective …

Is it the end of the DNSChanger Trojan?

Not really, especially in Latin America. Every day we register lots of similar attacks, each abusing local DNS settings. Actually these attacks are a bit different because they modify the local HOST file but the principle is the same – redirecting the victim to a malicious host via malicious DNS records. Latin American cybercriminals are …

The end of DNS-Changer

FBI’s “Operation Ghost Click” was discussed earlier by my colleague Kurt here and here and now it comes to an end.

Next Monday, 9th of July, at 06:00 (MEZ) the temporary DNS-servers setup by FBI will be shut down. But still there are still thousands of infected machines – one can wonder, what will happen …

New APT Attack Shows Technical Advance in Exploit Development

Recently, we came by an interesting targeted attack which was evading most antivirus products. This is a recent spearphish targeting various Tibetan and human rights activists. It demonstrates the level of effort put into infiltrating their groups with some unique characteristics, relative to the many other exploits targeting CVE-2012-0158. Here’s how such e-mails appear: …

Case Flame

Flame (aka Flame aka Skywiper) is a massive, complex piece of malware, used for information gathering and espionage.

The malware is most likely created by a western intelligence agency or military. It has infected computers in Iran, Lebanon, Syria, Sudan and elsewhere.

There seems to be a clear difference in how online espionage is done …

We Need More Than Jelly Bean

Google is set to launch Android 5.0, aka Jelly Bean, this fall. But do we even need it? While Google has made some steps in securing its Play branded marketplace, and offered a few security updates to the operating system, it is a fact that the most targeted Android platform is still 2.x. Why is …

Fake anti-virus disguises used by Android malware

The Android malware threat is growing.

As financially-motivated cybercriminals realise there’s a real opportunity to make money, so we are seeing more attacks created and distributed which target Android devices.

And it’s no surprise to see similar social engineering tricks that have worked on other operating systems in the past also being used on the Android platform.

Like …

Keeping Tabs on the Next STUXNET

The security industry is currently buzzing with talks about a threat dubbed as the precursor to the next STUXNET.

According to a Symantec analysis, portions of the code are very similar to STUXNET, and was likely written by the same cybercriminals as the well-known threat. Unlike STUXNET, however, Duqu does not have code that suggests it …

Is Anti-Malware Redundant When You Have URL Filtering?

A common misconception is that URL filtering is enough protection on the Secure Web Gateway, and that there’s little need for anti-malware (anti-virus) scanning. Before we explain why you really need both WebFilter (URL filtering) and ProxyAV (anti-malware) in your Secure Web Gateway deployment, let’s first explain what each one of these features actually does.

Virus Bulletin Conference – Day 2

The programme of the second day of the VB conference was very mixed.

In the corporate stream we have seen sessions about MacOSX Malware, Android Malware and various techniques to identify and analyze distributed attacks.

In the technical stream there also were many interesting presentations about mobile malware, malware analysis, and two presentations which try …

Lab Matters – Kaspersky Academy – a platform for connection

Kaspersky Lab is paying a lot of attention to IT security education & literacy development sharing its knowledge & experience actively through its educational program “Kaspersky Academy” which offers unique opportunities for students & young professionals to improve their knowledge of IT security, gain new experience and communicate with industry experts, realize their …