• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Search results for: command line interface

Windows Firewall Interface Issue in Handling Exceptions

  • Posted on:September 2, 2005 at 3:07 pm
  • Posted in:Bad Sites
  • Author:
    Rainer Link (Senior Threat Researcher)
1

Microsoft has just released an advisory disclosing how a flaw in the Windows Firewall graphical user interface may hide an exception from showing up in the Exceptions list. This unexpected behavior is be triggered by a malformed registry entry. Windows Firewall is configured to block incoming network connections by default. However, a system administrator can…

Read More

Outlaw Group Distributes Botnet for Cryptocurrency-Mining, Scanning, and Brute-Force

  • Posted on:November 19, 2018 at 5:12 am
  • Posted in:Botnets, Internet of Things, Malware
  • Author:
    Trend Micro
0

We spotted two variants of activities from hacking group Outlaw. The script used in the first version of its bot has two functionalities: the miner and Haiduc-based dropper. The second variant of the code, distributed by the bot, was mainly designed to brute force and further exploit the Microsoft Remote Desktop Protocol and cloud administration cPanel in order to escalate the privileges.

Read More
Tags: cPanelCryptocurrency miningMoneroperlRDP

Perl-Based Shellbot Looks to Target Organizations via C&C

  • Posted on:November 1, 2018 at 12:04 am
  • Posted in:Botnets, Internet of Things, Malware
  • Author:
    Trend Micro Cyber Safety Solutions Team
0

We uncovered an operation of a hacking group, which we’re naming “Outlaw” (translation derived from the Romanian word haiduc, the hacking tool the group primarily uses), involving the use of an IRC bot built with the help of Perl Shellbot. The group distributes the bot by exploiting a common command injection vulnerability on internet of things (IoT) devices and Linux servers. Further research indicates that the threat can also affect Windows-based environments and even Android devices.

Read More
Tags: androidIOTIRC botLinuxWindows

Misconfigured Container Abused to Deliver Cryptocurrency-mining Malware

  • Posted on:October 25, 2018 at 1:56 pm
  • Posted in:Exploits, Malware
  • Author:
    Trend Micro
0

We recently observed cases of abuse of the systems running misconfigured Docker engine with Docker application program interface (API) ports exposed. We also noticed that the malicious activities were focused on scanning for open ports 2375/TCP and 2376/TCP, which are used by the Docker engine daemon (dockerd). The intrusion attempts to deploy a cryptocurrency-mining malware (detected by Trend Micro as Coinminer.SH.MALXMR.ATNE) on the misconfigured systems.

Docker implements virtualization on the operating-system (OS) level — also known as containerization. The Docker APIs, in particular, allow remote users to control Docker images like a local Docker client does. Opening the API port for external access is not recommended, as it can allow hackers to abuse this misconfiguration for malicious activities.

Read More
Tags: cloudContainerDevOpsDocker

Ransomware as a Service Princess Evolution Looking for Affiliates

  • Posted on:August 9, 2018 at 6:01 am
  • Posted in:Bad Sites, Malware, Ransomware
  • Author:
    Joseph C Chen (Fraud Researcher)
0

We have been observing a malvertising campaign via Rig exploit kit delivering a cryptocurrency-mining malware and the GandCrab ransomware since July 25. On August 1, we found Rig’s traffic stream dropping a then-unknown ransomware. Delving into this seemingly new ransomware, we checked its ransom payment page in the Tor network and saw it was called Princess Evolution (detected by Trend Micro as RANSOM_PRINCESSLOCKER.B), and was actually a new version of the Princess Locker ransomware that emerged in 2016. Based on its recent advertisement in underground forums, it appears that its operators are peddling Princess Evolution as a ransomware as a service (RaaS) and are looking for affiliates.

Read More
Tags: Princess Evolutionransomwarerig exploit kit
Page 1 of 1112 › »

Security Predictions for 2019

  • Our security predictions for 2019 are based on our experts’ analysis of the progress of current and emerging technologies, user behavior, and market trends, and their impact on the threat landscape. We have categorized them according to the main areas that are likely to be affected, given the sprawling nature of the technological and sociopolitical changes under consideration.
    Read our security predictions for 2019.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Popular Posts

  • Going In-depth with Emotet: Multilayer Operating Mechanisms
  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.