Home » Bad Sites

App Stores that Formerly Coddled ZNIU Found Distributing a New iXintpwn/YJSNPI Variant

Posted on:November 2, 2017 at 5:00 am
Posted in:Bad Sites, Malware, Mobile
Author:
Mobile Threat Response Team

We covered iXintpwn/YJSNPI in a previous blog post and looked into how it renders an iOS device unresponsive by overflowing it with icons. This threat comes in the form of an unsigned profile that crashes the standard application that manages the iOS home screen when installed. The malicious profile also exploits certain features to make iXintpwn/YJSNPI more difficult to uninstall.

We recently discovered a new variant of iXintpwn/YJSNPI (detected by Trend Micro as IOS_YJSNPI.A) that uses a signed profile to conduct different attacks compared to its predecessor. IOS_YJSNPI.A is extracted from either of the two app stores—hxxp://m[.]3454[.]com and hxxp://m[.]973[.]com. Based on our analysis, this new variant’s main purpose is not to damage users’ operating systems, but to lure users into downloading repackaged apps.

Posted on:October 18, 2017 at 7:00 am
Posted in:Bad Sites, Exploits, Ransomware
Author:
Joseph C Chen (Fraud Researcher)

A new ransomware is being distributed by the Magnitude exploit kit: Magniber (detected by Trend Micro as RANSOM_MAGNIBER.A), which we found targeting South Korea via malvertisements on attacker-owned domains/sites. The development in Magnitude’s activity is notable not only because it eschewed Cerber—its usual ransomware payload—in favor of Magniber. Magnitude now also appears to have become an exploit kit expressly targeting South Korean end users.

The Magnitude exploit kit, which previously had a global reach, was offered as a service in the cybercriminal underground as early as 2013. It then left the market and became a private exploit kit that mainly distributed ransomware such as CryptoWall. At the start of the second half of 2016, Magnitude shifted focus to Asian countries, delivering various ransomware such as Locky and Cerber. More recently though, we noticed that Magnitude underwent a hiatus that began on September 23, 2017, and it then returned on October 15. With help from Kafeine and malc0de, we were able to uncover Magnitude’s new payload, Magniber.

Posted on:September 25, 2017 at 5:00 am
Posted in:Bad Sites, Malware, Mobile, Vulnerabilities
Author:
Mobile Threat Response Team

The Linux vulnerability called Dirty COW (CVE-2016-5195) was first disclosed to the public in 2016. The vulnerability was discovered in upstream Linux platforms such as Redhat, and Android, which kernel is based on Linux. It is categorized as a serious privilege escalation flaw that allows an attacker to gain root access on the targeted system. Dirty COW attacks on Android has been silent since its discovery, perhaps because it took attackers some time to build a stable exploit for major devices. Almost a year later, Trend Micro researchers captured samples of ZNIU (detected as AndroidOS_ZNIU)—the first malware family to exploit the vulnerability on the Android platform.

Posted on:September 22, 2017 at 9:01 am
Posted in:Bad Sites
Author:
Joseph C Chen (Fraud Researcher)

We’ve uncovered the notorious EITest campaign delivering a JavaScript (JS) cryptocurrency miner (detected by Trend Micro as HKTL_COINMINE) using tech support scams as a social engineering lure. These are fraud activities impersonating legitimate technical support services, conning unwitting victims to avail/pay for these services (or hand out financial data), by scaring them that their machine has been infected with malware, for instance.

The EITest campaign’s main arsenal is compromised websites. Its activity can be traced to as early as 2014 and once used the Angler exploit kit to deliver ransomware. Starting January 2017, it has eschewed exploit kits in favor of “HoeflerText” (a popular font) phishing attacks or . In a month, we identified 990 compromised websites injected with a malicious script that diverts the would-be victim to a website related to the tech support scam. Of late, though, the campaign has added the Coinhive JS miner into ongoing attacks, turning the victim’s computer into a Monero cryptocurrency miner. Analysis also revealed that this JS cryptocurrency miner is the same “Coinhive” JS miner found embedded in The Pirate Bay’s website.

Page 4 of 335 « ‹ 345 › »

App Stores that Formerly Coddled ZNIU Found Distributing a New iXintpwn/YJSNPI Variant

Magnitude Exploit Kit Now Targeting South Korea With Magniber Ransomware

ZNIU: First Android Malware to Exploit Dirty COW Vulnerability

EITest Campaign Uses Tech Support Scams to Deliver Coinhive’s Monero Miner

Security Predictions for 2018

Business Process Compromise

Stay Updated

App Stores that Formerly Coddled ZNIU Found Distributing a New iXintpwn/YJSNPI Variant

Magnitude Exploit Kit Now Targeting South Korea With Magniber Ransomware

Business Process Compromise and the Underground’s Economy of Coupon Fraud

ZNIU: First Android Malware to Exploit Dirty COW Vulnerability

EITest Campaign Uses Tech Support Scams to Deliver Coinhive’s Monero Miner

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated