New Flashback Variant Using Twitter as Backup C&C Channel

The latest version of the Flashback malware that’s infecting Macs has a new command-and-control infrastructure that used Twitter as a fallback mechanism in case the normal C&C system isn’t available. This is not the first time a botnet has used Twitter for some form of command and control, but it...

Questions Abound On Size and Makeup of Flashback Botnet

The botnet assembled by the Flashback Trojan that’s been infecting Macs in recent months is turning out to be a rather difficult one to pin down. Researchers have said that the network of compromised machines may be upwards of 600,000, while newere estimates say that it’s more likely in the...

Active Zeus C&Cs Remain Following Microsoft Takedown

It appears that Microsoft’s recent Zeus takedown attempt left some bots behind. Days after the company announced it had sinkholed the troublesome botnet, researchers say that there are still some C&C domains active. FireEye Malware Intelligence Lab’s Atif Mushtaq is reporting that, despite a...

Office based Trojan threat for Mac OS X by Chinese hackers

Office based Trojan threat for Mac OS X by Chinese hackers Security company ESET watches the newly found Trojan for OS X establish connections and receive commands to steal information. Earlier this month, researchers from AlienVault and Intego reported a new malware attack targeting Tibetan NGOs...

MacControl Trojan Being Used in Targeted Attacks Against OS X Users

Welcome to the age of targeted attacks, Mac users. Perhaps having grown tired of owning Windows machines around the world for the last few years, attackers in China now have taken up the challenge of going after Macs with the same kind of targeted attack tactics that have served them so well in t...

New TGLoader Android Malware Found in Alternative Markets

Alternative mobile app markets have become a great place to find new games, utilities and other apps. But mostly they’re great if you’re looking for the latest stealthy Android malware. The newest example is a piece of malware called TGLoader that is showing up in repackaged legitimate apps and h...

Microsoft, Financial Groups Execute Takedown of Zeus Botnet Servers

Microsoft has gone after another botnet, this time targeting some of the command-and-control infrastructure behind the Zeus network with a takedown effort that included seizing two IP addresses used for C&C servers and filing suit against 39 unnamed defendants. The action against Zeus is the late...

Variant of Zeusbot/Spyeye Botnet uses p2p network model

Variant of Zeusbot/Spyeye Botnet uses p2p network model Cybercriminals are using a modified version of the Zeusbot/Spyeye, which is using a peer-to-peer P2P network architecture, rather than a simple bot to command-and-control C&C server system, making the botnet much harder to take down, Symante...

Researchers Discover Android Mobile Botnet 100k Strong

A newly discovered malicious application circulating on third party Android markets in China has created a botnet that contains more than 100,000 compromised devices, researchers report. Researchers from North Carolina State University and Symantec say the malware, dubbed RootStrap NC State...

Ongoing Targeted Attack Campaign Going After Defense, Aerospace Industries

Researchers have identified a strain of malware that’s being used in a string of targeted attacks against defense contractors, government agencies and other organizations by leveraging exploits against zero-day vulnerabilities. The attacks may have been going on since 2009 in some form and the...

Attackers Moving Zeus Servers to Former Soviet Union TLD

The groups of attackers that employ the Zeus toolkit for their scams and malware campaigns have long used sites in the .ru Russian TLD as homes for their botnet controllers. Security researchers and law enforcement agencies have had a difficult time making headway in getting these domains taken...

Koobface Gang Shuts Down C&C Server, Drops Offline

The crew behind the Koobface worm, who have been quite open about their exploits and financial gains from their work in the past, now seem to be ducking underground as pressure is building on them in the wake of exposures of their operation and real identities. The command-and-control server used...

Koobface Gang Apparently Hiding in Plain Sight

The individuals allegedly responsible for wreaking havoc on Facebook with the infamous Koobface botnet are living lavishly, blatantly flaunting their ill-gotten gains and taking little precautions to cover their tracks. Their locations, travels, business ventures, social media personas, Internet...

More Details of Sykipot Exploits Of Adobe Reader Flaw Surface

More evidence is beginning to emerge that the Adobe Reader zero-day bug revealed recently is being used in targeted attacks against companies and federal agencies. Researchers recently have come across fresh samples of malware exploiting the vulnerability by using files crafted to draw in employe...

Duqu Attackers Wiped Out C&C Infrastructure After Public Disclosures

Researchers have known for years that virus writers and attackers pay close attention to the analyses researchers do of their work, and it appears that the Duqu authors are no exception. Shortly after the first public reports about Duqu emerged in early autumn, the crew behind Duqu wiped out all ...

Windows Kernel Zero Day Vulnerability Found in Duqu Installer

Windows Kernel Zero Day Vulnerability Found in Duqu Installer Duqu malware attack exploited a zero-day vulnerability in the Windows kernel, according to security researchers tracking the Stuxnet-like cyber-surveillance Trojan. The vulnerability has since been reported to Microsoft and Microsoft i...

The Mystery of Duqu

First of all, we feel it necessary to clarify some of the confusion surrounding the files and their names related to this incident. To get a full understanding of the situation you only need to know that we’re talking about just two malicious programs here at a minimum – the main module and a...

Attackers Adjusting Tactics to Evade Reputation Systems

BARCELONA–As in life, reputations on the Internet take time to build up. Attackers interested in making a quick buck aren’t necessarily the most patient lot, so as the various repuation systems on the Web have gotten more sophisticated and accurate, the bad guys have had to adjust their tactics a...

Mac trojan poses as PDF to open botnet backdoor

Mac trojan poses as PDF to open botnet backdoor There's another Mac OS X Trojan out in the wild, and it might be heading your way.If you open the file, which could appear as an emailed attachment or as a Web link, the document, written in traditional Chinese ideograms, does indeed display. But a...

Ice IX: Not Cool At All

My colleague Jorge Mieres recently found a C&C server of a botnet based on a malicious program called Ice IX. As announced on several user forums, Ice IX is a bot created using the source code of ZeuS 2.0.8.9, which became publicly available in May. The author of the new bot says the program...