Stories From Two Years in an IoT Honeypot

SINT MAARTEN—Curious just how susceptible some of the more vulnerable IoT devices are, a researcher set up a series of honeypots at his friends’ houses to record traffic, exploit attempts and other statistics. Dan Demeter, a junior security researcher with Kaspersky Lab’s Global Research and...

No More Ransom — 15 New Ransomware Decryption Tools Available for Free

No More Ransom, so is the Ransomware Threat. Launched less than a year ago, the No More Ransom NMR project has increased its capacity with new partners and new decryption tools added to its now global campaign to combat Ransomware. Started as a joint initiative by Europol, the Dutch National...

Keys for Dharma Ransomware Released

Victims of the Dharma strain of ransomware can now get their files back, free of charge. Decryption keys for the ransomware were added to the Kaspersky Lab’s Rakhni decryptor tool Thursday morning. Dharma ransomware .dharma decryptor released pic.twitter.com/sIQorypOzj — Anton Ivanov @antonivanov...

Windows Botnet Spreading Mirai Variant

A Chinese-speaking attacker is spreading a Mirai variant from a repurposed Windows-based botnet. Researchers at Kaspersky Lab published a report today, and said the code was written by an experienced developer who also built in the capability to spread the IoT malware to Linux machines under...

Valve Patches Trivial XSS Bug in Steam

Valve Corp., has patched a cross-site scripting vulnerability on its popular Steam gaming platform that could be exploited by viewing a maliciously crafted profile. The flaw could allow an attacker to carry out phishing attacks or execute malicious scripts just by opening a crafted profile page. ...

New “Fileless Malware” Targets Banks and Organizations Spotted in the Wild

More than a hundred banks and financial institutions across the world have been infected with a dangerous sophisticated, memory-based malware that's almost undetectable, researchers warned. Newly published report by the Russian security firm Kaspersky Lab indicates that hackers are targeting bank...

Nicolas Brulez on Malware Reverse Engineering Tips and Tricks

Kaspersky Lab Principal Security Researcher Nico Brulez talks with Ryan Naraine about his upcoming SAS 2017 training on the ins and outs of malware reverse engineering and how attendees can benefit for a wide range of tips and tricks. Download:...

Carbanak Using Google Services for Command and Control

Carbanak certainly has not sat idly by after years of advanced criminal campaigns targeting primarily financial institutions. The outfit, alleged to have stolen from more than 100 banks worldwide, has popped up again with a new means of managing command and control over its malware and implants...

Costin Raiu on the Importance of Using YARA

Ryan Naraine talks with Costin Raiu, the Global Director of GReAT at Kaspersky Lab, about the benefits of taking the YARA training class available at SAS 2017. Listen to learn about how YARA can be used in malware hunting, data analysis and incident response activities. Download:...

New Decryptor Unlocks CryptXXX v3 Files

Researchers have neutralized the threat of the latest strain of the CryptXXX v.3 ransomware, releasing a decryption tool for unlocking files, and have added it to the RannohDecryptor, a free utility hosted by Kaspersky Lab’s No Ransom Project. Previous decryption tools had been available for...

InPage Zero Day Used in Attacks Against Banks

A zero-day vulnerability in InPage publishing software used primarily in Urdu, Pashto and Arabic-speaking nations has been publicly exploited in attacks against financial institutions and government agencies in the region. While there are more than 10 million InPage users in Pakistan and India...

5 Major Russian Banks Hit With Powerful DDoS Attacks

Distributed Denial of Service DDoS attacks have risen enormously in past few months and, mostly, they are coming from hacked and insecure internet-connected devices, most commonly known as Internet of Things IoT. Recent DDoS attack against DNS provider Dyn that brought down a large chunk of the...

FruityArmor APT Group Used Recently Patched Windows Zero Day

One of the four zero-day vulnerabilities Microsoft patched last week was being used by an APT group called FruityArmor to carry out targeted attacks, escape browser-based sandboxes, and execute malicious code in the wild. Anton Ivanov, a researcher at Kaspersky Lab, was credited by Microsoft for...

StrongPity APT Covets Secrets of Crypto Users

APT groups covet secrets, and one in particular has chosen to target users intent on protecting theirs. The group is known as StrongPity, and it’s been a characteristic APT outfit using its share of zero days and modular attack tools to infiltrate victims and conduct espionage. This summer,...

Researchers Break MarsJoke Ransomware Encryption

Victims infected with the MarsJoke ransomware can decrypt their files after researchers last week cracked the encryption in the CTB-Locker lookalike. A trio of researchers from Kaspersky Lab’s Anti-Ransom Team–Anton Ivanov, Orkhan Mamedov, and Fedor Sinitsyn–described Monday how errors in the...

Phony Pokémon GO Android App Gave Attackers Root Access

A rogue and malicious app that billed itself as a “Guide for Pokémon GO” managed to make it into Google Play’s marketplace. Once installed, the malware-laced app gave attackers root access to any Android device it was installed on. The app, actually a Trojan in disguise, contained a nasty piece o...

Lurk Criminal Gang Also Behind Angler Exploit Kit

The June arrest of a Russian cybercrime gang responsible for the Lurk Trojan also put to rest the infamous Angler Exploit Kit. Researchers at Kaspersky Lab today published a detailed report on the Lurk takedown, confirming at the same time the connection between the Lurk gang and Angler. Activity...

Kaspersky Company Account - FileManager Vulnerability

Document Title: =============== Kaspersky Company Account - FileManager Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1924 Video: https://www.vulnerability-lab.com/getcontent.php?id=1976 Release Date: ============= 2016-08-30 Vulnerabili...

RIPPER ATM Malware Uses Malicious EMV Chip

Update This story was updated Aug. 31. A never-before-seen malware family known as RIPPER is being blamed for a rash of ATM heists in Thailand last week. The malware, found by researchers at FireEye, is responsible for the theft of 12 million baht $378,000 from ATMs at banks across Thailand. The...

Dutch, Belgian Ransomware Wildfire Disrupted, Decryption Keys Posted

The No More Ransom initiative released decryption keys for yet another strain of ransomware this week; now victims of the mostly Dutch-leaning ransomware called WildFire can get their files back without paying attackers. According to an update from the Dutch National Police on Wednesday, when it...