To answer the question we posed before: Yes, cybercriminals and terrorists are more similar than we think – they use similar platforms and services online, but also with some key differences.Read More
April 2016 was a great month for putting cybercriminals in prison. On April 12 Paunch, the creator of the infamous Blackhole exploit kit, was sentenced to seven years in a Russian prison. This was soon followed by Aleksandr Panin, the creator of SpyEye: he was sentenced by a United States federal court to nine and a half years in prison for his role in creating SpyEye. One of his partners, Hamza Bendelladj, was sentenced to fifteen years.
The most recent case involved Esthost, a company we know very well from our research. Vladimir Tsastsin became the latest member of the Esthost gang to be sentenced to jail; he will spend more than 7 years in prison. He was also ordered to forfeit more than $2.5 million in property.Read More
Are terrorists really any different from cybercriminals? We stumbled upon terrorist content during our investigations on cybercriminal activity in the underground, and after a thorough analysis of it, we uncovered parallels in the way these two distinct groups operate online.
Terrorists’ usage of the Internet in their operations has been under heavy discussions as of late, with recent events such as the Paris and Belgium attacks bringing the controversial subject to the forefront. When terrorist groups make use of the latest cyber technologies, techniques, and applications spanning across mobile, surface web, as well as deep and dark web, it makes the problem of tracking them even that much harder.Read More
In the first four months of 2016, we have discovered new families and variants of ransomware, seen their vicious new routines, and witnessed threat actors behind these operations upping the ransomware game to new heights. All these developments further establish crypto-ransomware as a lucrative cybercriminal enterprise. As we predicted, this year is indeed shaping up to be the year of online extortion, and while the security industry may be doing an admirable job of keeping up with the latest new tactic and providing solutions, the not-so informed public and organizations may very well be on the receiving end of a crippling malware that can destroy personal and corporate files, as well as lead to huge financial losses.Read More
In early April of this year a zero-day exploit (designated as CVE-2016-1019) was found in Adobe Flash Player. This particular flaw was soon used by the Magnitude Exploit Kit, which led to an Adobe out-of-cycle patch. This flaw was being used to lead to drive-by download attacks with Locky ransomware as the payload.
However, this did not end the threat for users. We recently saw a new variant of this attack that added an unusual twist. On top of the Flash exploit, an old escalation of privileges exploit in Windows (CVE-2015-1701) was used to bypass sandbox technologies.Read More