New Adobe Reader Zero-Day Vulnerability spotted in the wild

FireEye researchers recently came across a zero-day security flaw in Adobe Reader that's being actively exploited in the wild. The zero-day vulnerability is in Adobe PDF Reader 9.5.3, 10.1.5, 11.0.1 and earlier versions. According to researchers, once malware takes advantage of the flaw, its...

Adobe Investigating Reports of Reader Zero-Day Exploit

UPDATE-Attackers are using malicious PDFs posing as an application for an international travel visa to exploit a zero-day vulnerability in Adobe Reader and Acrobat, a researcher at FireEye told Threatpost today. The exploit is the first to escape the sandbox included in Reader X and above. Zheng...

Business Partners Give Hackers Easy Access to Secure Firms

As frequently targeted, high-value companies continue fortifying their defenses, FireEye researchers claim that attackers are increasingly setting their sights on the affiliated but not-as-well-protected third-party organizations that do business with them. By aiming phishing email campaigns at...

New Malware Can't Be Caught Napping

The aptly named Trojan Nap, a stealthy type of malware recently discovered by researchers at FireEye is able to evade detection methods by tricking scanners into thinking it’s asleep. This is according to researchers Abhishek Singh and Ali Islam with the California-based security firm who wrote o...

Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Microsoft Interne...

Chinese Hackers exploiting Internet Explorer Zero Day vulnerability for Cyber Espionage

Web site for the Council on Foreign Relations was compromised and recently hit by a drive-by attack that was detected earlier this week. Hacker are suspected to be from China , who are exploiting a zero day Internet Explorer vulnerability for Cyber Espionage attack against one of American most...

Chinese Hackers exploiting Internet Explorer Zero Day vulnerability for Cyber Espionage

Web site for the Council on Foreign Relations was compromised and recently hit by a drive-by attack that was detected earlier this week. Hacker are suspected to be from China , who are exploiting a zero day Internet Explorer vulnerability for Cyber Espionage attack against one of American most...

Korean Cyber espionage attack Targets Russia

Ask an expert on cyber espionage and he for sure he will speak of China, the most active and advanced country in this sector, this time a clamorous campaign apparently originated from Korea has been discovered. Security company FireEye collected evidences of a cyber espionage campaign, named...

'Sanny' Malware Targeting Russian Space, IT, Telecom Industries

Attackers, purportedly hailing from Korea, have been targeting individuals in Russia’s aerospace, IT, education and telecommunication industries with hopes of extracting their passwords and credentials. According to a post on FireEye’s Malware Intelligence Lab by researchers Alex Lanstein and Ali...

New Backdoor DDoS Malware Co-Existing on Gh0stRAT-Infected Machines

Gh0st RAT has a new roommate. A new backdoor called ADDNEW has been discovered on machines infected with the Gh0st remote access Trojan, adding new distributed denial of service attack capabilities, as well as a feature that targets passwords and credentials stored on the Firefox browser. Gh0st R...

Social Engineers Launch New Attack on Embattled Banks

As a number of major U.S. financial institutions deal with the aftermath of what was perhaps the largest DDoS campaign ever, researchers at FireEye are reporting on a separate phishing attack that establishes a channel of malicious communications on its victims’ computers. The attack is affecting...

Backdoor.LV Samples On the Rise

A strain of malware called Backdoor.LV that uses a custom protocol over port 80 to communicate with its command and control server has been consistently increasing its reach since May, according to a report from FireEye. The security firm observed Backdoor.LV determining its host’s NetBIOS name,...

JRE remote code execution 0DAY-vulnerability warning-the black bar safety net

Warning: this site provides programmethodmay carry offensive,for security research and teaching purposes,at your own risk! // // CVE-2 0 1 2-XXXX Java 0day // // reported here: http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html // // secret host / ip : ok.aa24.net /...

FireEye spotted Critical 0-day vulnerability in Java Runtime Environment

FireEye's Malware Intelligence Lab is making the claim that there is a new zero day vulnerability in the wild that affects the latest version of Java.Researcher. Atif Mushtaq wrote on the company's blog that he spotted the initial exploit on a domain that pointed to an IP address in China. The...

New Java Zero Day Being Used in Targeted Attacks

There is a newly discovered zero day vulnerability in Java 7 that is being used in some targeted attacks right now. The vulnerability works against Internet Explorer and Firefox and researchers say that attackers are exploiting in the wild and installing a version of the Poison Ivy RAT on...

Java 7 Applet - Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class Metasploit3 false def initialize inf...

MyAgent Trojan Targets Defense and Aerospace Industries

FireEye Security experts are analyzing a targeted trojan that leverages emailed PDF files to gain access to systems and deliver its payload to specified networks in the aerospace, chemical, defense and tech industries. "We have seen different versions of this malware arriving as an exe inside a...

Email Trojan Targeting Defense, Aerospace and Other Industries

What has the makings of a targeted attack campaign against several high-value industries is using a Trojan that employs rigged PDFs to deliver its payload. Targeting organizations in the defense, chemical, technology, and aerospace industries, the MyAgent trojan is primarily spreading through ema...

Grum Botnet Briefly Revived, Now Dead Again

Botnets are a lot like dandelions; you think they’re dead and then when you’re not looking they pop right back up. It’s happened time and again in the malware ecosystem and the latest member of the undead botnet society is Grum, which was only just taken down last week. Over the weekend several o...

Researchers Pull the Plug on Remaining Grum Botnet C&C Servers

Just a couple of days after authorities in the Netherlands pulled the plug on two of the four command-and-control servers behind the Grum spam botnet, the remaining C&C servers have been taken offline as well, thanks to a cooperative effort among researchers. As a result, the number of...