Russian Parliamentary Election Marred by DDoS Campaign

Yesterday was election day in Russia, and the occasion brought with it a coordinated campaign reportedly designed to silence some specific groups. A report from GlobalVoices.org details a massive wave of DDoS attacks against blogging platforms, election watchdog Websites, and various independent...

dns-zeustracker NSE Script

Checks if the target IP range is part of a Zeus botnet by querying ZTDNS @ abuse.ch. Please review the following information before you start to scan: Example Usage nmap -sn -PN --script=dns-zeustracker Script Output Host script results: | dns-zeustracker: | Name IP SBL ASN Country Status Level...

JBoss Worm Exploiting Old Bug to Infect Unpatched Servers

There is a new worm circulating right now that is compromising servers running older versions of the JBoss Application Server and then adding them to a botnet. The worm also attempts to install a remote access tool in order to give the attacker control over the newly infected server. The worm has...

P2P Version of Zeus Botnet Appears

A new version of the Zeus malware has appeared, and this does not seem to be a minor upgrade, but a major custom version of the Trojan, which now sports a P2P capability that does away with the use of the domain-generation algorithm used in earlier versions and instead uses a hardcoded list of IP...

Optima DDOS 10a Botnet leaked on Underground Forums

Optima DDOS 10a botnet leaked on Underground Forums On underground forums "Optima DDOS 10a Botnet " full version posted for all to download and use. Complete new version of the acclaimed DDoS bot Optima Darkness. In this new version 10a according to the author was raised in secrecy bot system and...

Optima DDOS 10a Botnet leaked on Underground Forums

Optima DDOS 10a botnet leaked on Underground Forums On underground forums "Optima DDOS 10a Botnet" full version posted for all to download and use. Complete new version of the acclaimed DDoS bot Optima Darkness. In this new version 10a according to the author was raised in secrecy bot system and...

Fed Seeks Industry Standard for Botnet Mitigation

The Departments of Commerce and Homeland Security met with various other government agencies and private-sector leaders yesterday to discuss the need for a code of conduct for detecting, mitigating, and otherwise dealing with botnets. The invitational meeting was hosted by the Center for Strategi...

Botnet Takedown: Researcher Describes How Kelihos Fell

Dennis Fisher talks with Kaspersky Lab Researcher Tillmann Werner about the takedown of the Kelihos botnet, the network’s unique multi-tiered architecture, its custom protocol and the ethics and legality of pushing updates to disable bots on users’ machines. Podcast audio courtesy of sykboy65...

The Inside Story of the Kelihos Botnet Takedown

Earlier this week, Microsoft released an announcement about the disruption of a dangerous botnet that was responsible for spam messages, theft of sensitive financial information, pump-and-dump stock scams and distributed denial-of-service attacks. Kaspersky Lab played a critical role in this botn...

Microsoft Takes Down Kelihos Botnet

Continuing its legal assault on botnet operators and the hosting companies that the criminals use for their activities, Microsoft has announced new actions against a group of people it contends are responsible for the operation of the Kelihos botnet. The company has also helped to take down the...

Mac trojan poses as PDF to open botnet backdoor

Mac trojan poses as PDF to open botnet backdoor There's another Mac OS X Trojan out in the wild, and it might be heading your way.If you open the file, which could appear as an emailed attachment or as a Web link, the document, written in traditional Chinese ideograms, does indeed display. But a...

Mac trojan poses as PDF to open botnet backdoor

Mac trojan poses as PDF to open botnet backdoor There's another Mac OS X Trojan out in the wild, and it might be heading your way.If you open the file, which could appear as an emailed attachment or as a Web link, the document, written in traditional Chinese ideograms, does indeed display. But a...

New Aldi Botnet Aims to Be "People's Bot" for Under $10

A new, exceptionally cheap botnet builder has surfaced called Aldi Bot and is for sale online for as little as US $8. Aldi Bot first appeared in August and is named after the popular supermarket chain, according to a post this week on GData’s SecurityBlog. Its authors initially offered it for €10...

Aldi Bot - Buy a Botnet just in 10 Euros

Aldi Bot - Buy a Botnet just in 10 Euros Researchers of German security firm G Data have discovered that a bot builder dubbed "Aldi Bot" is currently being offered for that much on underground forums. The Aldi Bot Builder appears to be based on the ZeuS source code. The malware has nothing to do...

Aldi Bot - Buy a Botnet just in 10 Euros

Aldi Bot - Buy a Botnet just in 10 Euros Researchers of German security firm G Data have discovered that a bot builder dubbed "Aldi Bot" is currently being offered for that much on underground forums. The Aldi Bot Builder appears to be based on the ZeuS source code. The malware has nothing to do...

German Web-Servers HTTP Flooding DDoS

A Distributed Denial of Service DDoS threat by a Bitcoin Mining botnet has been reported...

Vulnerability Discovered in SpyEye Botnet, Exploit Available for Download

Vulnerability Discovered in SpyEye Botnet, Exploit Available for Download Blind SQL injection Vulnerability Discovered in SpyEye Botnet by S4uR4 r00tw0rm.com Exploit : Vulnn type : Blind SQL injection vuln script : frmcardsedit.php Affected version : ALL May use any botnet from : What is SpyEye ?...

Vulnerability Discovered in SpyEye Botnet, Exploit Available for Download

Vulnerability Discovered in SpyEye Botnet , Exploit Available for Download Blind SQL injection Vulnerability Discovered in SpyEye Botnet by S4uR4 r00tw0rm.com Exploit : Vulnn type : Blind SQL injection vuln script : frmcardsedit.php Affected version : ALL May use any botnet from...

Ice IX: Not Cool At All

My colleague Jorge Mieres recently found a C&C server of a botnet based on a malicious program called Ice IX. As announced on several user forums, Ice IX is a bot created using the source code of ZeuS 2.0.8.9, which became publicly available in May. The author of the new bot says the program...

BitCoin Forum Hacked, Injected With Bill Cosby Images

A hacker compromised a digital currency forum, bitcointalk.org, stealing email addresses and hashed passwords, reading messages, and, of all things, peppering the site with images Bill Cosby, according to a report from SC Magazine. The report claims that the attacker gained root access and starte...