Home » Spam

XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails

Posted on:April 19, 2018 at 6:00 am
Posted in:Malware, Spam
Author:
Trend Micro

We discovered a spam campaign that delivers the notorious cross-platform remote access Trojan (RAT) Adwind a.k.a. jRAT (detected by Trend Micro as JAVA_ADWIND.WIL) alongside another well-known backdoor called XTRAT a.k.a XtremeRAT (BKDR_XTRAT.SMM). The spam campaign also delivered the info-stealer Loki (TSPY_HPLOKI.SM1).

DUNIHI (VBS_DUNIHI.ELDSAVJ), a known VBScript with backdoor and worm capabilities, was also seen being dropped with Adwind via spam mail in a separate incident. Notably, cybercriminals behind the Adwind-XTRAT-Loki and Adwind-DUNIHI bundles abuse the legitimate free dynamic DNS server hopto[.]org. The delivery of different sets of backdoors is believed to be a ploy used to increase the chances of system infection: If one malware gets detected, the other malware could attempt to finish the job.

Posted on:December 20, 2017 at 12:22 am
Posted in:Exploits, Malware, Spam
Author:
Trend Micro

The Cobalt hacking group was one of the first to promptly and actively exploit CVE-2017-11882 (patched last November) in their cybercriminal campaigns. We uncovered several others following suit in early December, delivering a plethora of threats that included Pony/FAREIT, FormBook, ZBOT, and Ursnif. Another stood out to us: a recent campaign that used the same vulnerability to install a “cracked” version of the information-stealing Loki.

Posted on:November 20, 2017 at 4:00 am
Posted in:Exploits, Malware, Spam
Author:
Trend Micro

The waves of backdoor-laden spam emails we observed during June and July that targeted Russian-speaking businesses were part of bigger campaigns. The culprit appears to be the Cobalt group, based on the techniques used. In their recent campaigns, Cobalt used two different infection chains, with social engineering hooks that were designed to invoke a sense of urgency in its recipients—the bank’s employees.

Of note were Cobalt’s other targets. The hacking group’s first spam run also targeted a Slovenian bank, while the second run targeted financial organizations in Azerbaijan, Belarus, and Spain.

Posted on:October 19, 2017 at 5:01 am
Posted in:Ransomware, Spam
Author:
Rubio Wu (Threats Analyst)

Ransomware has been one of the most prevalent, prolific, and pervasive threats in the 2017 threat landscape, with financial losses among enterprises and end users now likely to have reached billions of dollars. Locky ransomware, in particular, has come a long way since first emerging in early 2016. Despite the number of times it apparently spent in hiatus, Locky remains a relevant and credible threat given its impact on end users and especially businesses. Our detections show that it’s making another comeback with new campaigns.

A closer look at the file-encrypting malware’s activities reveals a constant: the use of spam. While they remain a major entry point for ransomware, Locky appears to be concentrating its distribution through large-scale spam campaigns of late, regardless of the variants released by its operators/developers.

Posted on:October 17, 2017 at 5:00 am
Posted in:Malware, Spam
Author:
Trend Micro Forward-Looking Threat Research Team

This blog post summarizes our findings from studying internet traffic going in and out of North Korea. It reviews its small IP space of 1024 routable IP addresses. It will also cover spam waves that originate in part from spambots in the country, DDoS attacks against North Korean websites and their relation to real-world events, as well as recurring watering hole attacks on North Korean websites.

Page 1 of 9812 › »

XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails

CVE-2017-11882 Exploited to Deliver a Cracked Version of the Loki Infostealer

Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks

A Look at Locky Ransomware’s Recent Spam Activities

A Closer Look at North Korea’s Internet

Security Predictions for 2018

Business Process Compromise

Stay Updated

XTRAT and DUNIHI Backdoors Bundled with Adwind in Spam Mails

CVE-2017-11882 Exploited to Deliver a Cracked Version of the Loki Infostealer

Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks

A Look at Locky Ransomware’s Recent Spam Activities

A Closer Look at North Korea’s Internet

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated