The Latest Android Overlay Malware Spreading via SMS Phishing in Europe

Introduction In April 2016, while investigating a Smishing campaign dubbed RuMMS that involved the targeting of Android users in Russia, we also noticed three similar Smishing campaigns reportedly spreading in Denmark February 2016, in Italy February 2016, and in both Denmark and Italy April 2016...

Necurs Botnet is Back, Updated Locky and Dridex

The notorious Necurs botnet is back in business, after mysteriously going dark for nearly a month. Researchers report the Necurs has returned to spewing massive volumes of email containing an improved version of the potent Locky ransomware and the Dridex banking Trojan. According to Proofpoint...

Exploit Kits Attacking Adobe Flash Player Zero Day

Update Exploits for the most recent Adobe Flash Player zero-day vulnerability have been integrated into the Angler, Neutrino and Magnitude exploit kits, and are leading compromised computers to different ransomware strains, banking malware, and a credential-stealing Trojan. A French researcher wh...

Targeted Attacks against Banks in the Middle East

UPDATE Dec. 8, 2017: We now attribute this campaign to APT34, a suspected Iranian cyber espionage threat group that we believe has been active since at least 2014. Learn more about APT34 and their late 2017 targeting of a government organization in the Middle East. Introduction In the first week ...

Targeted Attacks against Banks in the Middle East

Introduction In the first week of May 2016, FireEye’s DTI identified a wave of emails containing malicious attachments being sent to multiple banks in the Middle East region. The threat actors appear to be performing initial reconnaissance against would-be targets, and the attacks caught our...

Ecuador Bank Hacked — $12 Million Stolen in 3rd Attack on SWIFT System

Bangladesh is not the only bank that had become victim to the cyber heist. In fact, it appears to be just a part of the widespread cyber attack on global banking and financial sector by hackers who target the backbone of the world financial system, SWIFT. Yes, the global banking messaging system...

Attacks on SWIFT Banking System Benefit From Insider Knowledge

ARCHIVED STORY Attacks on SWIFT Banking System Benefit From Insider Knowledge By Trellix · May 20, 2016 In recent months, we’ve seen headlines about the compromise of a bank in Bangladesh from which cybercriminals attempted to steal US$951 million. The malware they used was able to manipulate and...

Attacks on SWIFT Banking System Benefit From Insider Knowledge

ARCHIVED STORY Attacks on SWIFT Banking System Benefit From Insider Knowledge By Trellix · May 20, 2016 In recent months, we’ve seen headlines about the compromise of a bank in Bangladesh from which cybercriminals attempted to steal US$951 million. The malware they used was able to manipulate and...

Banking Trojan Outwits Google Play Malware Scanner

Google Play’s first line of defense against malware was circumvented by attackers who managed to sneak a malicious app called “Black Jack Free” into the official app store. The app was discovered by Lookout Security and removed by Google last week. Lookout estimates that 5,000 people downloaded t...

Second Bank hit by Malware attack similar to $81 Million Bangladesh Heist

SWIFT, the global Society for Worldwide Interbank Financial Telecommunications, warned on Thursday of a second malware attack similar to the Bangladesh central bank hack one that led to $81 million cyber heist. In February, $81 Million cyberheist at the Bangladesh central bank was carried out by...

FreedomPop Account Hijacking Flaws Remain Unpatched

It took close to two months, but free wireless and mobile provider FreedomPop has acknowledged reports of a serious vulnerability in its service. U.K.-based researcher Paul Moore told Threatpost that FreedomPop, which has been operating in the U.K. since last September, finally responded to a bug...

Phony Google Update Spreads Android Malware

Android users are being warned of a phony Google update that is pushing malware onto devices. The attackers behind this scheme are domain squatting URLs that are similar to ones used by Google for legitimate updates, hoping to snare less-than-vigilant users. Researchers at Zscaler said yesterday ...

Моб. банк Русский Стандарт - Customized SSL, Dangerous filesystem permissions, Runtime privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application Моб. банк Русский Стандарт published at the 'play' market has multiple vulnerabilities...

GozNym Trojan Attackers Set Sights on Europe, Poland

The banking malware GozNym has legs; only a few weeks after the hybrid Trojan was discovered, it has reportedly spread into Europe and begun plaguing banking customers in Poland with redirection attacks. The malware has started targeting corporate, SMB, investment banking and consumer accounts at...

Lloyds Bank Mobile Banking - Base64 encoded String, Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Lloyds Bank Mobile Banking published at the 'play' market has multiple vulnerabilities...

CompuSource Systems Real Time Home Banking - Local Privilege Escalation

Exploit Title: CompuSource Systems - Real Time Home Banking - Local Privilege Escalation/Arbitrary Code Execution Date: 2/25/16 Exploit Author: [email protected] Vendor Homepage: https://www.css4cu.com : https://www.css4cu.com/Next/InfoSide/SoftwareSolutions.php Version: CompuSource System...

CompuSource Systems - Real Time Home Banking - Privilege Escalation

Exploit for windows platform in category local exploits Exploit Title: CompuSource Systems - Real Time Home Banking - Local Privilege Escalation/Arbitrary Code Execution Date: 2/25/16 Exploit Author: email protected Vendor Homepage: https://www.css4cu.com :...

Unspecified Vulnerability in Oracle Financial Services Software Oracle FLEXCUBE Direct Banking Component (CNVD-2016-02479)

Oracle Financial Services Software is a set of Oracle's core banking, online banking and property management financial services software, of which Oracle FLEXCUBE Direct Banking is a set of Internet and mobile banking solution components. An unspecified vulnerability exists in the Pre-Login...

Unspecified Vulnerability in Oracle Financial Services Software Oracle FLEXCUBE Direct Banking Component

Oracle Financial Services Software is a set of Oracle's core banking, online banking and property management financial services software, of which Oracle FLEXCUBE Direct Banking is a set of Internet and mobile banking solution components. An unspecified vulnerability exists in the Accounts...

Unspecified Vulnerability in Oracle Financial Services Software Oracle FLEXCUBE Direct Banking Component (CNVD-2016-02477)

Oracle Financial Services Software is a set of Oracle's core banking, online banking and property management financial services software, of which Oracle FLEXCUBE Direct Banking is a set of Internet and mobile banking solution components. An unspecified vulnerability exists in the Login...