On November 2nd, 1988, the Morris worm was released by its author, and within 24 hours had caused damage across the world. It spread via the internet – and its release marked a new dawn for malicious software. Our five facts highlight what has changed since – and what hasn’t.
We have already discussed how a system gets infected with Win32/Nymaim ransomware. In this blog post, we reveal a new infection vector, a study of the different international locker designs and ransom prices as well as a complete technical analysis of its communication protocol.
Indonesia as a major source of malicious traffic? That’s what a recent infographic from content delivery network provider Akamai seemed to say. In her first article for We Live Security, ESET security researcher Lysa Myers investigates.
Security researchers from Autodesk, along with Microsoft, announced new features in AutoCAD to prevent malware in a presentation at Virus Bulletin 2013 in Berlin. We look at how a simple prompt can help keep users safe.
In this blog post, we will describe software detected by ESET products as Win32/Kankan, and explain why its discovery shocked many Chinese users, then we will provide an in-depth analysis of its functionalities – and discuss the evidence that Xunlei Networking Technologies is implicated.
Trojans that encrypt user files and try to extort a ransom from the victim in exchange for a decryptor utility are nothing new. We’ve noted a significant increase in Filecoder activity over the past few summer months – in this blog post we address the questions we’re getting about this issue.
Win32/Spy.Hesperbot is a new banking trojan that has been targeting online banking users in Turkey, the Czech Republic, Portugal and the United Kingdom. For more information about its malware spreading campaigns and victims, refer to our first blog post. In this post we’ll cover the technical details of the malware, including the overall architecture, as well as the mobile component.
A new and effective banking trojan has been discovered targeting online banking users in Turkey, the Czech Republic, Portugal and the United Kingdom. It uses very credible-looking phishing-like campaigns, related to trustworthy organizations, to lure victims into running the malware.
A few months ago on this blog I described PowerLoader functionality – including an interesting way for privilege escalation into the explorer.exe system process. The leaked PowerLoader code is also used in other malware families.
Orbit Downloader by Innoshock is a popular browser add-on often used to download embedded videos from sites such as YouTube. But the popular add-on has disturbing hidden functions.
Java has been – and still is – one of the more problematic issues security-wise. A website showing song lyrics from Golden Earring’s Radar Love shows off problems that can leave users at the mercy of Java attacks.
A new paper aims to profile the victims most likely to fall for a phishing attack. But what is less clear is how you develop a profile while avoiding the pitfalls of stereotyping.
Recently, our anti-virus laboratory discovered an interesting new modification of a file virus known as Expiro which targets 64-bit files for infection. File-infecting viruses are well known and have been studied comprehensively over the years, but malicious code of this type almost invariably aimed to modify 32-bit files. One such family of file viruses, called