Koobface Gang Shuts Down C&C Server, Drops Offline

The crew behind the Koobface worm, who have been quite open about their exploits and financial gains from their work in the past, now seem to be ducking underground as pressure is building on them in the wake of exposures of their operation and real identities. The command-and-control server used...

Duqu computer virus Detected by Iran civil defense organization

Duqu computer virus Detected by Iran civil defense organization The virus is called W32.Duqu, or just Duqu create fear after the opening Pandora's Box of Stuxnet. The head of Iran's civil defense organization told the official IRNA news agency that computers at all main sites at risk were being...

Duqu Attackers Using Word Docs As Attack Vector

As the analysis of the Duqu malware continues to evolve, the picture that’s emerging is becoming more and more intriguing. The latest bits of evidence uncovered show that not only do the attackers create custom files for each individual attack, there is evidence indicating that they might have be...

Duqu Analysis and Detection Tool by NSS Labs

Duqu Analysis and Detection Tool by NSS Labs NSS Labs has built a new, free tool that detects known and newly created Duqu drivers that have infiltrated systems, thus allowing security experts to further analyze the "functionality, capabilities and ultimate purpose of DuQu.". The Tool is availabl...

Duqu Installer Contains Windows Kernel Zero Day

A newly discovered installer for the Duqu malware includes an exploit for a previously unknown vulnerability in the Windows kernel that allows remote code execution. Microsoft is working on a fix for the kernel vulnerability right now. The exact location and nature of the flaw isn’t clear right...

Symantec Traces Attacks on Chemical Industry To 20 Year Old Chinese Hacker-For-Hire

A report from Symantec Corp. details a roving campaign of intellectual property theft controlled by a 20 year-old hacker for hire that relied on phishing e-mail, some old malware and command and control operations based in China. The company on Tuesday unveiled research on the targeted attacks,...

760+ Organizations, Including Google, Facebook, Targeted by RSA Attack

More than 760 organizations, 20 percent of them Fortune 100 companies, may have been compromised by RSA’s now infamous data breach in March, 2011, according to a report on Krebsonsecurity. Facebook, Google and Cisco Systems are just a few of the many organizations who were targets of malware usin...

Did the German Government Break The Law With Its Lawful Intercept Trojan?

The German government acknowledged on Tuesday that a trojan horse program used to perform lawful intercept is capable of far more than it was said to be. The confirmation comes after an analysis by hacking group The Chaos Computer Club CCC which alleged that the program may be in breach of the la...

Microsoft Takes Down Kelihos Botnet

Continuing its legal assault on botnet operators and the hosting companies that the criminals use for their activities, Microsoft has announced new actions against a group of people it contends are responsible for the operation of the Kelihos botnet. The company has also helped to take down the...

Mac trojan poses as PDF to open botnet backdoor

Mac trojan poses as PDF to open botnet backdoor There's another Mac OS X Trojan out in the wild, and it might be heading your way.If you open the file, which could appear as an emailed attachment or as a Web link, the document, written in traditional Chinese ideograms, does indeed display. But a...

Aldi Bot - Buy a Botnet just in 10 Euros

Aldi Bot - Buy a Botnet just in 10 Euros Researchers of German security firm G Data have discovered that a bot builder dubbed "Aldi Bot" is currently being offered for that much on underground forums. The Aldi Bot Builder appears to be based on the ZeuS source code. The malware has nothing to do...

Harnig Botnet Returns, But Without Rustock

The takedown of the Rustock botnet earlier this year has had ripple effects throughout the malware and spam ecosystems, with some large reductions in spam levels and attacks. However, some of the components of the malware machine driven by Rustock are beginning to come back online now. Researcher...

Study: Operation Shady Rat Revealed

Global 2000 companies can be split into two categories, according to the author of a new white paper from McAfee PDF; those that know they’ve been compromised and those that don’t yet know. “The only organizations that are exempt from this threat,” writes the paper’s author, Dmitri Alperovitch,...

GAO: The DoD's Plan To Unify Cyber Defenses Looks Like Swiss Cheese

A new report out from the Government Accountability Office GAO warns that the U.S. Department of Defense’s efforts to unify its cyber security operations has serious gaps and that the Department is “unprepared to meet the current threat” of cyber attack. The report, issued on Monday, is an...

TDSS rootkit infects 1.5 million US computers

TDSS rootkit infects 1.5 million US computers Millions of PCs around the world infected by the dangerous TDSS 'super-malware' rootkit as part of a campaign to build a giant new botnet. The report is presented by researchers from security firm Kaspersky Lab. TDSS also known as 'TDL' and sometimes ...

FBI Begins Purging Coreflood Infected PCs

The FBI has issued some 19,000 uninstall commands to the computers of 24 individuals infected by the Coreflood botnet, effectively purging their machines of that malware, and leaving behind no unintended consequences thus far according to a report from Brian Krebs. This move was made possible by...

Coreflood Takedown Raises Questions About Offensive Actions Against Botnets

For just about as long as there have been botnets, there’s been an ongoing discussion in the security and law-enforcement communities about the legality and ethics of taking proactive steps to disrupt the botnets’ operations and even to remove the bots from infected machines. Until very recently,...

FBI cracks International Bot Network !

FBI cracks International Bot Network ! The Department of Justice and FBI declared that it has cracked a network of hackers, who have infected almost 2 million computers with a harmful "bot" program, Coreflood that steals private and monetary data from computers. Identified as a "bot" network- as...

Report Describes Far-Flung Chinese Cyber Espionage Against U.S. Government

The massive campaign of cyber intrusions of U.S. government Web sites by China’s People’s Liberation Army PLA now has a name: “Byzantine Hades,” according to a report Thursday by Reuters. The report says that China has gained the upper hand over the U.S. in the arena of cyberwarfare, developing a...

DOJ Shuts Down Botnet, Disables Infected Systems

The U.S. Department of Justice and the FBI said on Wednesday that they had taken actions to disable an international botnet of more than two million infected computers that was stealing corporate data including user names, passwords and financial information. Thirteen unnamed “John Doe” defendent...