Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:


  • Zero-Day Alerts

  • Hacking Team Leak

  • Recent Posts

  • Calendar

    August 2015
    S M T W T F S
    « Jul    
     1
    2345678
    9101112131415
    16171819202122
    23242526272829
    3031  
  • Email Subscription

  • About Us


    Archive for the ‘Targeted Attacks’ Category




    A malware that is being tied to the recent cyber attack in France is detected by Trend Micro as a variant of the NJWORM/Kjw0rm remote access Trojan (RAT). This malware (with the MD5 hash of 2962c44ce678d6ca1246f5ead67d115a), which we detect as VBS_KJWORM.SMA, is backdoor that may have been around since 2014. Ties to previous targeted attacks Our initial analysis showed that VBS_KJWORM.SMA was created by a hacking tool named Sec-wOrm 1.2 Fixed vBS Controller. This is a RAT generator that we detect as HKTL_KJWORM. It ...

    Posted in Targeted Attacks | Comments Off on Kjw0rm VBS Malware Tied To Attacks on French TV Station TV5Monde



    The security of an enterprise is not only dependent on the organization itself, but also on the security of their IT supply chain and contractors. These represent potential weak points into the security of any organization. Third-party contractors and suppliers have been used to compromise larger organizations. Target's breach began with a breach of a contractor involved in heating, ventilation, and air conditioning (HVAC) solutions.  A 2011 hack on Lockheed Martin was blamed in part on information stolen from a hack on ...

    Posted in Targeted Attacks | Comments Off on Securing The IT Supply Chain



    Today, we are publishing a research paper on an ongoing operation launched by a threat actor group known as Rocket Kitten. Rocket Kitten Campaigns We have been able to observe two different campaigns launched by the group, one after the other, which reveal an evolution in the skills of this group. The first of these campaigns has already been exposed at 31C3 by Tillman Werner and Gadi Evron. That campaign started with traditional spear phishing e-mails that use basic social engineering techniques to entice the targeted ...

    Posted in Targeted Attacks | Comments Off on Operation Woolen-Goldfish: When Kittens Go Phishing



    Throughout course of my monitoring future and possible targeted attacks, I recently chanced upon a spear-phishing email sent to an undisclosed recipient that contains three seemingly harmless documents. I was curious about the attached documents so I first checked the one titled AlSajana Youth Center financial Report.docx. The so-called financial report turned out to be a non-malicious document (see Figure 1) but the other two attached files struck me as suspicious as well. Their file names were u0627u0644u0645u0639u062Fu064429u0.docx and u0625u0646u062Cu0644u064Au0632u0649.doc. Figure 1. Sample ...




    Information about the overall threat landscape can be gathered from many sources. One useful method is by looking at the overall activity of command-and-control (C&C) servers, as used in botnets, targeted attacks, and in attacks against the broader Internet user base. We are able to combine various threat intelligence sources, including feedback from the Trend Micro™ Smart Protection Network™, to get a glimpse of C&C server activity. (these are displayed in real time on the Global Botnet Map). Our findings below reflect the information ...

    Posted in Targeted Attacks | Comments Off on Investigating and Detecting Command and Control Servers


     

    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice