Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: cybercrime/malcode – Page 186

Cyber-espionage group Cloud Atlas has added polymorphic malware to its arsenal to avoid having its operations detected and monitored with the help of previously collected indicators of compromise (IOCs).

The hacking group also known as Inception [1, 2] was initially identified in 2014 by Kaspersky’s Global Research and Analysis Team researchers, and it has a history of targeting government agencies and entities from a wide range of industries via spear-phishing campaigns.

While the malware and Tactics, Techniques, and Procedures (TTP) Cloud Atlas uses during its operations has remained unchanged since at least 2018, the APT group has now added new polymorphic HTML Application malware dropper in the form of a malicious HTA and a backdoor dubbed VBShower.

Read more | >

Just five months ago at the RSA conference, the NSA released Ghidra, a piece of open source software for reverse-engineering malware. It was an unusual move for the spy agency, and it’s sticking to its plan for regular updates — including some based on requests from the public.

In the coming months, Ghidra will get support for Android binaries, according to Brian Knighton, a senior researcher for the NSA, and Chris Delikat, a cyber team lead in its Research Directorate, who previewed details of the upcoming release with CyberScoop. Knighton and Delikat are discussing their plans at a session of the Black Hat security conference in Las Vegas Thursday.

Before the Android support arrives, a version 9.1 will include new features intended to save time for users and boost accuracy in reverse-engineering malware — enhancements that will come from features such as processor modules, new support for system calls and the ability to conduct additional editing, known as sleigh editing, in the Eclipse development environment.

Read more | >

For five years, several AT&T employees were conspiring with a Pakistani man to install malware on company computers so that man could unlock millions of smartphones subsidized by the carrier, according to federal investigators.

On Tuesday, the Justice Department unsealed an indictment against Muhammad Fahd for bribing AT&T employees at a call center in Washington state to pull off the scheme. According to the feds, Fahd allegedly paid more than $1 million in bribes to the AT&T employees during the conspiracy, which allowed him to fraudulently unlock more than 2 million AT&T phones from 2012 to 2017.

Fahd allegedly partnered with businesses that offered cell phone unlocking services in exchange for a fee. These unnamed business would then supply him with the IMEI numbers of the phones bound to AT&T’s network.

Read more | >

With over 350,000 new malware samples emerging every day, it’s difficult for any one strain of malware to make a name for itself. Any single malware sample whose name you know — be it Mirai, WannaCry, or NotPetya — speaks to a trail of devastation.

In 2019, people are also hearing another name: Emotet.

But Emotet has been around in one form or another since 2014, and its first major resurgence was in 2017. In the beginning, Emotet was just one trojan among many — a particularly run-of-the-mill banking trojan that did some damage before being researched, understood, and dismissed in a flurry of signature updates.

Read more | >

Multiple German companies were off to a rough start last week when a phishing campaign pushing a data-wiping malware targeted them and asked for a ransom. This wiper is being named GermanWiper due to its targeting of German victims and it being a destructive wiper rather than a ransomware.

The malware was first reported on the BleepingComputer forum on Tuesday, July 30 and users soon learned after examining their files that it is a data wiper, despite it demanding a ransom payment.

Read more | >

Another dire warning for Windows users this week, after threat researchers at Proofpoint disclosed” a previously undocumented malware.” This one had a twist, though, this malware was not an attack in itself, it was an enabler, hiding on infected computers, establishing a proxy that other malware can then use to manage traffic to the PC and carry out their threats.

Read more | >