Today’s Data Breach Environment: An Overview

By now, companies and consumers alike are well aware of the threat of a data breach. Large and small businesses across every sector have been targeted, and many customers are now familiar with the notification that their username, password or other details might have been compromised. The...

Malwarebytes’ 2019 security predictions

Every year, we at Malwarebytes Labs like to stare into our crystal ball and foretell the future of malware. Okay, maybe we don't have a crystal ball, but we do have years and years of experience in observing trends and sensing shifts in patterns. When it comes to security, though, we can only kno...

L0rdix malware on dark web steals data, mines crypto & enslaves PCs as botnet

By Waqas There’s a new hacking tool circulating in the underground Dark Web forums that let cybercriminals target Microsoft Windows computers. It has become the newest universal go-to tool to attack a Windows machine because it presents an utterly lethal combination of data stealing, cryptomining...

This Week in Security News: Holiday Cybercriminals & Cryptomining Malware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn the common threats and the best practices for defending against cybercriminals during November’s online shopping season. Also, see the...

DarkGate: New password stealer & cryptomining malware hits Windows devices

By Waqas "DarkGate" malware uses Akamai, AWS DNS records and multiple payloads for cryptomining, credential theft and endpoint takeover. A sophisticated malware campaign has been identified by an enSilo researcher that hasn’t been detected before and is quite advanced than many of the malware...

400% increase in cryptomining malware attacks against iPhones

By Waqas It wouldn’t be wrong to state that Apple has become the apple of the eyes of cryptomining enthusiasts and cybercriminals. According to Check Point’s latest Global Threat Index, the company is being targeted more frequently in cryptomining malware attacks. The report discloses some...

Fake Adobe updates installing cryptomining malware while updating Flash

By Waqas The IT security researchers at Palo Alto Networks has identified that a fake Flash updater is circulating the web and fooling computer users by sneakily installing cryptocurrency mining bot XMRig. In the past few months, researchers have identified 113 fake updaters installing cryptomini...

Fake Adobe Flash Installers Come With a Little Malware Bonus

A clever new cryptomining scheme downloads the latest version of Adobe for you, but adds malware to the bargain...

New Drupalgeddon Attacks Enlist Shellbot to Open Backdoors

Researchers are warning of a new wave of cyberattacks targeting unpatched Drupal websites that are vulnerable to Drupalgeddon 2.0. What’s unique about this latest series of attacks is that adversaries are using PowerBot malware, an IRC-controlled bot also called PerlBot or Shellbot. Researchers a...

Shocking: Hackers using Googlebots in cryptomining malware attacks

By Waqas Hackers are abusing Googlebot servers to deliver malicious payloads. Last year, HackRead exclusively reported on how hackers were using Google Adwords and Google Sites to spread malware. Then came another shocking research from Cisco Talos exposing how hackers exploited Google Search...

Beers with Talos Ep. #38 — More fun with VPNFilter; Getting pwnd via spreadsheet

Beers with Talos BWT Podcast Ep. 38 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 38 show notes: Recorded Sept. 21, 2018 — The whole crew is back together! On the agenda today is VPNFilter part III, now...

Cybercriminals Target Kodi Media Player for Malware Distribution

The Kodi media player has emerged as a malware distribution platform for cybercriminals, recently becoming the target for a cryptomining campaign that compromised about 5,000 machines before being thwarted. Those victims are still at risk, researchers warned. Kodi is free and open-source, and can...

Lucy Gang Debuts with Unusual Android MaaS Package

There’s a fresh bloom in the malware-as-a-service garden: Researchers have uncovered a new Russian-speaking threat actor hawking a proprietary cyber-weapon dubbed “Black Rose Lucy.” The offering is a malware-as-a-service MaaS bundle with two parts, consisting of a controlling web interface which...

XBash Malware Packs Double Punch: Destroys Data and Mines for Crypto Coins

Researchers have discovered a new sophisticated malware family in the wild, which wrecks havoc on Windows and Linux systems with a combination of data destructive ransomware and malicious cryptomining. The malware, dubbed by Palo Alto Networks’ Unit 42 researchers who discovered it as Xbash, has...

Cyber Threat Alliance Releases Cryptomining Whitepaper

This post is authored by Ashlee Benge. Despite the recent devaluation of some cryptocurrencies, illicit cryptocurrency miners remain a lucrative and widespread attack vector in the threat landscape. These miners are easy to deploy, and attackers see it as a quick way to steal other users'...

Linux & Windows hit with disk wiper, ransomware & cryptomining Xbash malware

By Waqas Xbash is an "all in one" malware. Palo Alto Networks’ Unit 42 researchers have come to the conclusion that the notorious Xbash malware that has been attacking Linux and Windows servers is being operated by the Iron Group which is an infamous hacker collective previously involved in a...

ThreatList: Attacks on Industrial Control Systems on the Rise

The systems that power the manufacturing, power and water plants, the oil and gas industry, and many other sectors are increasingly in the crosshairs of cyber-attackers: A full 41.2 percent of industrial control system ICS were attacked by malicious software at least once in the first half of 201...

Active Campaign Exploits Critical Apache Struts 2 Flaw in the Wild

It was only a matter of time before attacks were seen in the wild, and now it’s happened. A known threat actor has mounted a large cryptomining campaign using the recently disclosed Apache Struts 2 critical remote code-execution vulnerability. It uses a new malware designed for persistence and...

Cryptomining scripts will be blocked in upcoming versions of Firefox browser

By Waqas In all the future versions of the Firefox web browser, cryptojacking malware will be blocked. Mozilla, the company behind Firefox browser, announced on August 30 that it is launching an anti-tracking initiative, which will be implemented broadly over the next few months. Firefox has cite...

New Threat Actor ‘Rocke’: A Rising Monero Cryptomining Menace

Researchers are warning of a Chinese-language threat actor leveraging a wide array of Git repositories to infect vulnerable systems with Monero-based cryptomining malware. Researchers at Cisco Talos, who discovered the threat actor they call “Rocke”, said they have been tracking the adversary sin...