Stabuniq Trojan rapidly stealing data from US banks

--- Trojan.Stabuniq geographic distribution by unique IP address Security researchers from Symantec have identified a new Trojan that appears to be targeting financial institutions. Dubbed Trojan.Stabuniq, the malware has been collecting information from infected systems potentially for the...

Android Trojan Apps Build SMS Botnet

A rudimentary, SMS-based botnet is ensnaring Android users into its web with a series of text messages offering free downloads for popular, paid gaming applications, according to Cloudmark researcher Andrew Conway. The Trojan applications are reportedly mimicking games such as The Need for Speed...

Zitmo Trojan Variant Eurograbber Beats Two-Factor Authentication to Steal Millions

Online banking customers in Europe are falling victim by the thousands to a new banking Trojan that is infecting Android and BlackBerry devices and is capable of defeating two-factor authentication. The Trojan, dubbed Eurograbber by researchers at Check Point Software Technologies and Verasafe, i...

DARPA Seeks Revolution, Not Evolution, in Cyberspace Capabilities

Defense Advanced Research Projects Agency DARPA, the avant-garde research and development arm of the Department of Defense – perhaps best known for its central role in the development of the Internet – is soliciting research proposals that would help the military improve its cyber battlespace...

Variant of Mac Malware Targets Tibetan Activists

A new variant of the Mac-based OS X Imuler Trojan has emerged and is targeting Tibetan rights activists, according to a report written by Lisa Myers of Web security firm Intego. This latest variant, detected by Intego as OSX/Imuler.E, is a Trojan dropper that attempts to lure victims with promise...

New Backdoor DDoS Malware Co-Existing on Gh0stRAT-Infected Machines

Gh0st RAT has a new roommate. A new backdoor called ADDNEW has been discovered on machines infected with the Gh0st remote access Trojan, adding new distributed denial of service attack capabilities, as well as a feature that targets passwords and credentials stored on the Firefox browser. Gh0st R...

Researchers caught espionage malware mastermind on webcam

In march 2011 CERT-Georgia has Discovered Cyber Espionage Attack Incident on country of Georgia. Advanced Malicious Software was Collecting Sensitive, Confidential Information about Georgian and American Security Documents and then uploading it to some of Command and Control Servers. After a...

New windows malware can target smart cards for full remote access

If you think that having a USB Token Smartcard is extremely secure for Digital signatures or other activities, you may be wrong! The research done by Paul Rascagneres can remotely give access to victims smartcard! What makes the attack unique is it uses a keylogger to get the PIN or password and...

Russian Web proxy with backdoors, Distributing malware

Antivirus company Symantec has detected a malicious campaign in which hackers managed to deceive thousands of people allegedly signed by a paid proxy service. They expose that hundreds of thousands of users signing up for a cheap and supposedly legitimate proxy service have ended up downloading...

Beacon : A new advance payload for Cobalt Strike

Raphael Mudge Creator of Cobalt Strike announced Another Advance Payload for Cobalt Strike called "Beacon". In a conversation with The Hacker News Raphael said "A big gap in the penetration tester's toolbox are covert command and control options, especially for long engagements. Beacon is a new...

Attack on SCADA Vendor Telvent Raises Concerns

Telvent, the maker of a SCADA product used in a number of critical industries, said that its corporate network has been compromised by attackers and that some of the files used by customers on their own networks were changed. This attack is the latest in what looks to be a series of incidents of...

Large-Scale Water Holing Attack Campaigns Hitting Key Targets

A new APT-style espionage campaign launched this summer targeting organizations tied to financial services, government agencies and the defense industry used a technique dubbed water holing to entice victims and silently redirect them to sites hosting zero-day exploits. Researchers at RSA Securit...

Grum Botnet Attempts Another Comeback, Fails Again

The Grum botnet, which Dutch authorities and security researchers knocked offline earlier this summer, made a second, unsuccessful attempt at a comeback over the weekend when the bot herders stood up two new command-and-control servers in Turkey. The revival was short-lived however, and both C&Cs...

New Iteration of TDSS/TDL-4 Botnet Uses Domain Fluxing to Avoid Detection

A new version of the TDSS/TDL-4 botnet is rapidly growing, primarily because it’s having great success using an evasion technique known as a domain generation algorithm DGA to avoid detection, researchers at Damballa Security revealed today. The algorithm helps the latest version of the botnet...

Microsoft Carries out Nitol Botnet Takedown

A botnet known as Nitol, built on the backs of PCs and laptops loaded with malware somewhere in the supply chain, was taken down by Microsoft. Microsoft’s Digital Crimes Unit was given permission this week by the U.S. District Court for the Eastern District of Virginia to take over the 3322.org...

Plugx RAT targeting government organizations in Japan using spear phishing

Roland Dela Paz Threat Researcher at TrendMirco reported that last year a Malware Campaign to target specific users in Japan, China, and Taiwan once again on rise using new breed of Remote Access Tool RAT called Plugx also known as Korplug. This new custom made version comes for less recognition...

Backdoor.LV Samples On the Rise

A strain of malware called Backdoor.LV that uses a custom protocol over port 80 to communicate with its command and control server has been consistently increasing its reach since May, according to a report from FireEye. The security firm observed Backdoor.LV determining its host’s NetBIOS name,...

Iran still on target of 'Mahdi' malware after detection

In JULY Kaspersky Lab and Seculert revealed the presence of a new cyber-espionage weapon known targeting users in the Middle East. Despite the recent uncovering of the 'Madhi' malware that has infected several hundred computers in the Middle East, researchers say the virus is continuing to spread...

Oracle Releases Fix For Java CVE-2012-4681 Flaw

Oracle on Thursday released a new version of Java that included a fix for the CVE-2012-4681 vulnerability that has been used in limited targeted attacks in the last couple of weeks. The release of Java 7 update 7 comes about four days after the Java flaw was publicly disclosed, but several months...

Use of Java Zero-Day Flaws Tied to Nitro Attack Crew

Researchers say that one of the attack groups using the two new Java zero-day vulnerabilities is the same group that was behind an earlier targeted attack campaign from 2011. That group was traced back to China and was essentially running a spear-phishing campaign, but now the crew, known as Nitr...