Home » Spam

Necurs Evolves to Evade Spam Detection via Internet Shortcut File

Posted on:April 26, 2018 at 6:00 am
Posted in:Malware, Spam
Author:
Trend Micro

Necurs, a botnet malware that’s been around since 2012, has been improved with the hopes of better defeating cybersecurity measures — it was seen to evolve its second layer of infection using a .URL file (with remote script downloaders detected by Trend Micro as MAL_CERBER-JS03D, MAL_NEMUCOD-JS21B, VBS_SCARAB.SMJS02, and MAL_SCARAB-VBS30.

Necurs, a modular malware with variants that are capable of spam distribution, information theft, and disabling security services and elements, has been in around since 2012, propagating in the wild via the Necurs botnet.

Posted on:April 19, 2018 at 6:00 am
Posted in:Malware, Spam
Author:
Trend Micro

We discovered a spam campaign that delivers the notorious cross-platform remote access Trojan (RAT) Adwind a.k.a. jRAT (detected by Trend Micro as JAVA_ADWIND.WIL) alongside another well-known backdoor called XTRAT a.k.a XtremeRAT (BKDR_XTRAT.SMM). The spam campaign also delivered the info-stealer Loki (TSPY_HPLOKI.SM1).

DUNIHI (VBS_DUNIHI.ELDSAVJ), a known VBScript with backdoor and worm capabilities, was also seen being dropped with Adwind via spam mail in a separate incident. Notably, cybercriminals behind the Adwind-XTRAT-Loki and Adwind-DUNIHI bundles abuse the legitimate free dynamic DNS server hopto[.]org. The delivery of different sets of backdoors is believed to be a ploy used to increase the chances of system infection: If one malware gets detected, the other malware could attempt to finish the job.

Posted on:December 20, 2017 at 12:22 am
Posted in:Exploits, Malware, Spam
Author:
Trend Micro

The Cobalt hacking group was one of the first to promptly and actively exploit CVE-2017-11882 (patched last November) in their cybercriminal campaigns. We uncovered several others following suit in early December, delivering a plethora of threats that included Pony/FAREIT, FormBook, ZBOT, and Ursnif. Another stood out to us: a recent campaign that used the same vulnerability to install a “cracked” version of the information-stealing Loki.

Posted on:November 20, 2017 at 4:00 am
Posted in:Exploits, Malware, Spam
Author:
Trend Micro

The waves of backdoor-laden spam emails we observed during June and July that targeted Russian-speaking businesses were part of bigger campaigns. The culprit appears to be the Cobalt group, based on the techniques used. In their recent campaigns, Cobalt used two different infection chains, with social engineering hooks that were designed to invoke a sense of urgency in its recipients—the bank’s employees.

Of note were Cobalt’s other targets. The hacking group’s first spam run also targeted a Slovenian bank, while the second run targeted financial organizations in Azerbaijan, Belarus, and Spain.

Posted on:October 19, 2017 at 5:01 am
Posted in:Ransomware, Spam
Author:
Rubio Wu (Threats Analyst)

Ransomware has been one of the most prevalent, prolific, and pervasive threats in the 2017 threat landscape, with financial losses among enterprises and end users now likely to have reached billions of dollars. Locky ransomware, in particular, has come a long way since first emerging in early 2016. Despite the number of times it apparently spent in hiatus, Locky remains a relevant and credible threat given its impact on end users and especially businesses. Our detections show that it’s making another comeback with new campaigns.

A closer look at the file-encrypting malware’s activities reveals a constant: the use of spam. While they remain a major entry point for ransomware, Locky appears to be concentrating its distribution through large-scale spam campaigns of late, regardless of the variants released by its operators/developers.

Page 1 of 9912 › »

Necurs Evolves to Evade Spam Detection via Internet Shortcut File

XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails

CVE-2017-11882 Exploited to Deliver a Cracked Version of the Loki Infostealer

Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks

A Look at Locky Ransomware’s Recent Spam Activities

Security Predictions for 2018

Business Process Compromise

Stay Updated

Necurs Evolves to Evade Spam Detection via Internet Shortcut File

XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails

CVE-2017-11882 Exploited to Deliver a Cracked Version of the Loki Infostealer

Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks

A Look at Locky Ransomware’s Recent Spam Activities

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated