We have just completed fresh analysis of the malicious software known as Win32/Festi. While the "Festi" botnet created with this malware has been in business since the autumn of 2009 we can see that the software is frequently updated, as described in our analysis, and these updates mean Festi continues to be a potent threat
Group-IB's joint investigations with the FSB and MVD resulted in the arrest of a gang of eight accused of larceny, creation of malware, and unauthorized access.
ESET is seeing a new step of evolution for the Rovnix bootkit family.
A new TDL4 sample includes novel privilege escalation mechanisms in the dropper and changes to the hidden storage system.
ESET researchers examine the evolution of bootkit threats targeting 64-bit Windows over 2011.
Java will consolidate its position as the successor to PDF and SWF in the favourite exploits stakes.
"Win32/Carberp: When You're in a Black Hole, Stop Digging" aggregates most of our published material on Carberp into a single resource.
This article examines the relationship between the Black Hole exploit kit and Win32/Carberp.
This month we discovered new information on a new modification in the Win32/TrojanDownloader.Carberp trojan family.
ESET Researchers have investigated Win32/Duqu's RPC mechanism.
For the last few days, much malware research time has been devoted to the brand-new malware that ESET calls Win32/Duqu. One of the features that makes this kind of malware particularly interesting is that it very closely resembles Stuxnet, one of the most sophisticated worms of recent years. Last year we performed in-depth analysis of
ESET researchers have noticed a new phase in the evolution of the TDL4 botnet.
ESET had quite a strong representation at Virus Bulletin this year in Barcelona, as David Harley mentioned in his post prior to the conference. On the first day, Pierre-Marc Bureau presented his findings about the Kelihos botnet, David Harley and AVG’s Larry Bridwell discussed the usefulness and present state of AV testing, and to finish
A new conference paper, two conference presentations, and an article for SC Magazine.
Virus Bulletin's annual conference is really one of the highlights of the year for the research community
ESET researchers Aleksandr Matrosov and Eugene Rodionov just gave a talk on Defeating x64: Modern Trends of Kernel-Mode Rootkits
During the first half of 2011 we have witnessed a significant growth in malware targeting 64-bit platforms, the most interesting examples of which are bootkits.
A week or so ago we promised you a full paper expanding on our Hodprot is a Hotshot blog. That paper is now available.
In their presentation “Cybercrime in Russia: Trends and issues” at CARO2011 -- one of the best presentations of the workshop, in my unbiased opinion ;-) -- Robert Lipovsky, Aleksandr Matrosov and Dmitry Volkov mentioned the Win32/Hodprot malware family, which seems to be undergoing something of a resurgence.
Although the “Ready to Ride” group originated in Russia it distributes Win32/Cycbot outside the borders of the Russian Federation. Going by the prices per installation the primary target of the group is the US.
