More Technical

Back in BlackEnergy *: 2014 Targeted Attacks in Ukraine and Poland

State organizations and private businesses from various sectors in Ukraine and Poland have been targeted with new versions of BlackEnergy, a malware that’s evolved into a sophisticated threat with a modular architecture.

Virus Bulletin presentations update

Updated information on ESET presentations at Virus Bulletin 2014.

Virus Bulletin, AVAR conferences: a tasty Conference Pair*

Autumn: the season of mists and mellow fruitfulness, not to mention a couple of excellent security conferences. Virus Bulletin and AVAR make a very tasty Conference Pair.

TorrentLocker now targets UK with Royal Mail phishing

Three weeks ago, iSIGHT Partners discovered a new Ransomware encrypting victims’ documents. They dubbed this new threat TorrentLocker. TorrentLocker propagates via spam messages containing a link to a phishing page where the user is asked to download and execute “package tracking information”. In August, only Australians were targeted with fake Australian Post package-tracking page. While

Win32/Aibatook: Banking Trojan Spreading Through Japanese Adult Websites

Win32/Aibatook targets Japanese bank customers with an unusual Internet Explorer monitoring technique. We believe the malware has been in development for months – and is now ready for take-off.

Targeted attack against Vietnamese government: right on the MONRE

ESET researchers recently came across a targeted attack against the Vietnamese government’s Ministry of Natural Resources and Environment (MONRE).

ESET Analyzes Simplocker – First Android File-Encrypting, TOR-enabled Ransomware

Last weekend saw the (somewhat anticipated) discovery of an interesting mobile trojan – the first spotting of a file-encrypting ransomware for Android by our detection engineers.

Virus Bulletin review: 2 eBooks offering security guidance

An article for Virus Bulletin by David Harley reviews two eBooks offering security advice to consumers.

Facebook Webinject Leads to iBanking Mobile Bot

iBanking is a malicious Android application that when installed on a mobile phone is able to spy on its user’s communications. This bot has many interesting phone-specific capabilities, including capturing incoming and outgoing SMS messages, redirecting incoming voice calls, and even capturing audio using the device’s microphone.

Windigo not Windigone: Linux/Ebury updated

There have been some interesting new developments since we published our report on Operation Windigo. In this blog post you will read about a Linux/Ebury update, and the reaction of the criminal gang to our post.

Win32/Sality newest component: a router’s primary DNS changer named Win32/RBrute

DNS hijacking is still going strong and the Win32/Sality operators have added this technique to their long-lasting botnet. This blog post describes how the malware guesses router passwords as part of its campaign to misdirect users, send spam and infect new victims.

Over 500,000 PCs attacked every day after 25,000 UNIX servers hijacked by Operation Windigo

Malware researchers at ESET have uncovered a widespread cybercriminal operation that has seized control of tens of thousands of Unix servers. Learn more about how to check your systems for compromise, and prevent innocent computer users from being attacked.

Operation Windigo – the vivisection of a large Linux server-side credential-stealing malware campaign

Our report titled “Operation Windigo – the vivisection of a large Linux server-side credential-stealing malware campaign” details our analysis of a set of malicious programs that infect servers and desktop PCs, and send nearly 500,000 web users to malicious content daily.”

An In-depth Analysis of Linux/Ebury

In this blog post, we provide an in-depth analysis of Linux/Ebury – the most sophisticated Linux backdoor ever seen by our researchers. It is built to steal OpenSSH credentials and maintain access to a compromised server.

Windows exploitation in 2013

The year 2013 was notable for the appearance of 0-day vulnerabilities that were primarily used in targeted attacks. In this case, criminal hackers worked on developing exploits, only not for random propagation of malicious code, but rather for use in attacks on specific users.

Rob Slade: The truth about quantum cryptography – and what it means for privacy

‘The first thing you need to know about quantum cryptography is that it isn’t cryptography. At least, not the quantum part,’ writes Rob Slade, information security researcher, author and malware expert.

Boaxxe adware: ‘A good advert sells the product without drawing attention to itself’ Part 2

In this post, we examine the complex it fits into a larger click fraud ecosystem, where users can be redirected either automatically, or through search engines browsing, to advertisement websites.

Boaxxe adware: ‘A good ad sells the product without drawing attention to itself’ – Pt 1

This is the first in a series of two blog posts on the malware family Win32/Boaxxe.BE whose end goal is to drive traffic to advertisement websites by using various click fraud techniques, and thus earn money from these websites as an “advertiser”.

The Death of Anti-Virus: conference paper

Death of a Sales Force: Whatever Happened to Anti-Virus? is a paper written by Larry Bridwell and myself for the 16th AVAR conference in Chennai, which was kindly presented by ESET’s Chief Research Officer Juraj Malcho, as neither Larry nor myself were able to attend the conference in the end. The paper is also available

Qadars – a banking Trojan with the Netherlands in its sights

The first sign we saw of this malware was in mid-May 2013, but it is still very active, and uses Android to bypass two-factor authentication systems. It clearly seeks to infect Dutch computers – 75% of detections come from this region.

Follow us

Copyright © 2015 ESET, All Rights Reserved.