More Technical

Operation Windigo – the vivisection of a large Linux server-side credential-stealing malware campaign

Our report titled “Operation Windigo – the vivisection of a large Linux server-side credential-stealing malware campaign” details our analysis of a set of malicious programs that infect servers and desktop PCs, and send nearly 500,000 web users to malicious content daily.”

An In-depth Analysis of Linux/Ebury

In this blog post, we provide an in-depth analysis of Linux/Ebury – the most sophisticated Linux backdoor ever seen by our researchers. It is built to steal OpenSSH credentials and maintain access to a compromised server.

Windows exploitation in 2013

The year 2013 was notable for the appearance of 0-day vulnerabilities that were primarily used in targeted attacks. In this case, criminal hackers worked on developing exploits, only not for random propagation of malicious code, but rather for use in attacks on specific users.

Rob Slade: The truth about quantum cryptography – and what it means for privacy

‘The first thing you need to know about quantum cryptography is that it isn’t cryptography. At least, not the quantum part,’ writes Rob Slade, information security researcher, author and malware expert.

Boaxxe adware: ‘A good advert sells the product without drawing attention to itself’ Part 2

In this post, we examine the complex it fits into a larger click fraud ecosystem, where users can be redirected either automatically, or through search engines browsing, to advertisement websites.

Boaxxe adware: ‘A good ad sells the product without drawing attention to itself’ – Pt 1

This is the first in a series of two blog posts on the malware family Win32/Boaxxe.BE whose end goal is to drive traffic to advertisement websites by using various click fraud techniques, and thus earn money from these websites as an “advertiser”.

The Death of Anti-Virus: conference paper

Death of a Sales Force: Whatever Happened to Anti-Virus? is a paper written by Larry Bridwell and myself for the 16th AVAR conference in Chennai, which was kindly presented by ESET’s Chief Research Officer Juraj Malcho, as neither Larry nor myself were able to attend the conference in the end. The paper is also available

Qadars – a banking Trojan with the Netherlands in its sights

The first sign we saw of this malware was in mid-May 2013, but it is still very active, and uses Android to bypass two-factor authentication systems. It clearly seeks to infect Dutch computers – 75% of detections come from this region.

New Hesperbot targets: Germany and Australia

In September we informed about a new banking trojan called Hesperbot (detected as Win32/Spy.Hesperbot). The perpetrators responsible for the threat are still active – November has been particularly eventful. In this post, we’ll give an update on the situation and malware developments.

Did you say “Advanced” Persistent Threats?

Once in a while we get to spend time analyzing malicious code that is not as widespread as other threats we’ve encountered. Here we analyze a targeted attack used in Taiwan and Vietnam – but is this ‘APT’ really that advanced?

Chronology of a Skype attack

By the middle of May, users around the world started to receive messages from their contacts through different instant-messaging applications, such as Skype and Gtalk – an attack that showed off how age-old techniques can ensnare thousands of users. Here, we analyze this attack.

Windows 8.1 – security improvements

A new white paper, titled Windows 8.1 Security – New and Improved, looks at the some of the most anticipated—and controversial—security features of this new “.1″ point release of Windows 8.

Five interesting facts about the Morris worm (for its 25th anniversary)

On November 2nd, 1988, the Morris worm was released by its author, and within 24 hours had caused damage across the world. It spread via the internet – and its release marked a new dawn for malicious software. Our five facts highlight what has changed since – and what hasn’t.

Nymaim: Browsing for trouble

We have already discussed how a system gets infected with Win32/Nymaim ransomware. In this blog post, we reveal a new infection vector, a study of the different international locker designs and ransom prices as well as a complete technical analysis of its communication protocol.

Is this how Indonesia topped the malicious traffic charts?

Indonesia as a major source of malicious traffic? That’s what a recent infographic from content delivery network provider Akamai seemed to say. In her first article for We Live Security, ESET security researcher Lysa Myers investigates.

Solutions to current antivirus challenges

The detection and blocking of malicious code employed by modern threats, whether targeted attacks or mass-spreading campaigns, has been a game of cat-and-mouse for some time now. Is it time for a new approach?

A prompt to save the world: new security features against malware in AutoCAD

Security researchers from Autodesk, along with Microsoft, announced new features in AutoCAD to prevent malware in a presentation at Virus Bulletin 2013 in Berlin. We look at how a simple prompt can help keep users safe.

Win32/KanKan – Chinese drama

In this blog post, we will describe software detected by ESET products as Win32/Kankan, and explain why its discovery shocked many Chinese users, then we will provide an in-depth analysis of its functionalities – and discuss the evidence that Xunlei Networking Technologies is implicated.

Win32/Napolar – A new bot on the block

There is a new bot on the block. ESET identifies it as Win32/Napolar while its author calls it solarbot. This piece of malware came to our attention mid-August because of its interesting anti-debugging and code injection techniques.

Filecoder: Holding your data to ransom

Trojans that encrypt user files and try to extort a ransom from the victim in exchange for a decryptor utility are nothing new. We’ve noted a significant increase in Filecoder activity over the past few summer months – in this blog post we address the questions we’re getting about this issue.

Follow us

Copyright © 2015 ESET, All Rights Reserved.