• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Archives for August 2016

New Version of Cerber Ransomware Distributed via Malvertising

  • Posted on:August 31, 2016 at 8:28 pm
  • Posted in:Exploits, Malware, Ransomware
  • Author:
    Joseph C Chen (Fraud Researcher)
0

CerberĀ has become one of the most notorious and popular ransomware families in 2016. It has used a wide variety of tactics including leveragingĀ cloud platformsĀ and Windows ScriptingĀ and adding non-ransomware behavior such as distributed denial-of-service attacksĀ to its arsenal. One reason for this popularity may be because it is frequently bought and sold as a service (ransomware-as-a-service, or RaaS).

The latest version of Cerber had functions found in earlier versions like the use of voice mechanism as part of its social engineering tactics. Similar to previous variants, Cerber 3.0 is dropped by the Magnitude and Rig exploit kits.

Read More
Tags: CERBERMagnitude exploit kitmalvertisingransomwarerig exploit kit

Locky Ransomware Now Downloaded as Encrypted DLLs

  • Posted on:August 29, 2016 at 4:56 am
  • Posted in:Malware, Ransomware
  • Author:
    Brooks Li (Threats Analyst)
0

The Locky ransomware family has emerged as one of the most prominent ransomware families to date, being sold in the Brazilian underground and spreading via various exploits. Locky has, over time, become known for using a wide variety of tactics to spread–including macros, VBScript, WSF files, and now, DLLs.

Recently we encountered a new Locky variant (detected as RANSOM_LOCKY.F116HM)Ā that used old tactics on the surface, but with some key technical changes.Ā The emails that were used to distribute it were fairly pedestrian as far as these messages go, although it was part of a large-scale spam campaign.

Read More
Tags: LockyPRNGransomwareUHE PRNG

New Open Source Ransomware Based on Hidden Tear and EDA2 May Target Businesses

  • Posted on:August 25, 2016 at 4:00 am
  • Posted in:Malware, Ransomware
  • Author:
    Trend Micro
0

In a span of one to two weeks, three new open source ransomwareĀ strains have emerged, which are based on Hidden TearĀ and EDA2. These new ransomware families specifically look for files related to web servers and databases, which could suggest that they are targeting businesses.

Both Hidden Tear and EDA2 are considered as the first open source ransomware created for educational purposes. However, these were quickly abused by cybercriminals.Ā RANSOM_CRYPTEAR.B is one of the many Hidden Tear spinoffs that infect systems when users access a hacked website from Paraguay. Magic ransomware (detected as RANSOM_MEMEKAP.A), based on EDA2, came soon after CRYPTEAR.B’s discovery.

Read More
Tags: EDA2FsocietyHidden TearKaoTearOpen sourcePogoTear

Ransomware and Business Email Compromise (BEC) Lead Year of Online Extortion

  • Posted on:August 23, 2016 at 5:15 am
  • Posted in:Malware, Ransomware, Social, Targeted Attacks
  • Author:
    Trend Micro
0

Emails have become the battleground for the first half of the year in terms of security. It is the number one infection vector that have ushered in 2016’s biggest threats so far—ransomware and business email compromise (BEC). Ransomware infections normally start via email. Based on our findings, 71% of the known ransomware families’ delivery method is through spam.

Looking at the threat trends so far, both ransomware and BEC have proved profitable across the world. This echoes our prediction that 2016 would be the Year of Online Extortion. Ransomware continues to threaten business-critical data and cost organization thousands of dollars in losses; BEC scams bank on social engineering lures that lead even companies’ top decision-makers to transfer huge sums of money—totaling to over US$3 billion in estimated losses.

Read More
Tags: 1H 2016 security roundupBECbusiness email compromiseexploit kitsspam mails

When Hackers Hack Each Other—A Staged Affair in the French Underground?

  • Posted on:August 23, 2016 at 12:10 am
  • Posted in:Deep Web
  • Author:
    Cedric Pernet (Threat Researcher)
0

Recently, Trend Micro published a blog post on a new illegal gambling system known as ā€œFrench Dark Bets (FDB).ā€ FDB is run and hosted by one of the biggest French underground marketplace, the French Dark Net (FDN). This betting system runs entirely on Bitcoins (BTC), which make it easy for cybercriminals to inject and collect money through this platform.

Over the last few weeks, a series of events caught our attention: The FDN and FDB went offline and came back online within a few days, announcing that they were hacked and money was stolen. Following this incident, FDN went back online with changed features.

Read More
Tags: FDBFDNFrench Dark BetFrench Dark NetFrench underground
Page 1 of 3123

Security Predictions for 2020

  • Cybersecurity in 2020 will be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to technological developments and global threat intelligence — only so defenders can keep up with the broad range of threats.
    Read our security predictions for 2020.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Popular Posts

Sorry. No data so far.

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, ę—„ęœ¬, ėŒ€ķ•œėÆ¼źµ­, å°ē£
  • Latin America Region (LAR): Brasil, MĆ©xico
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Ɩsterreich / Schweiz, Italia, Š Š¾ŃŃŠøŃ, EspaƱa, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.