The return of the BOM

There's nothing new in Brazilian cybercriminals trying out new ways to stay under the radar. It's just that this time around the bad guys have started using a method that was reported in the wild years ago. Russian gangs used this technique to distribute malware capable of modifying the hosts fil...

Necurs Botnet Evolves to Hide in the Shadows, with New Payloads

Necurs, the prolific and globally dispersed spam and malware distribution botnet, has been spotted using a fresh hiding technique to avoid detection while quietly adding more bots to its web. According to research from Black Lotus Labs, which is telecom and ISP provider CenturyLink’s network...

Combing Through Brushaloader Amid Massive Detection Uptick

Nick Biasini and Edmund Brumaghin authored this blog post with contributions from Matthew Molyett. Executive Summary Over the past several months, Cisco Talos has been monitoring various malware distribution campaigns leveraging the malware loader Brushaloader to deliver malware payloads to...

Ford: Subdomain takeover on usclsapipma.cv.ford.com

Hello Ford H1 team, I want to report a Subdomain takeover vulnerability in this report, a pretty serious security issue in some context. Overview: One of the ford.com subdomains is pointing to Azure, which has unclaimed CNAME record. ANYONE is able to own ford.com subdomain at the moment. This...

Emotet re-emerges after the holidays

While Emotet has been around for many years and is one of the most well-known pieces of malware in the wild, that doesn't mean attackers don't try to freshen it up. Cisco Talos recently discovered several new campaigns distributing the infamous banking trojan via email. These new campaigns have...

Distributing Malware By Becoming an Admin on an Open-Source Project

The module "event-stream" was infected with malware by an anonymous someone who became an admin on the project. Cory Doctorow points out that this is a clever new attack vector: Many open source projects attain a level of "maturity" where no one really needs any new features and there aren't a lo...

Metamorfo Banking Trojan Keeps Its Sights on Brazil

This blog post was authored by Edmund Brumaghin, Warren Mercer, Paul Rascagneres, and Vitor Ventura. Executive Summary Financially motivated cybercriminals have used banking trojans for years to steal sensitive financial information from victims. They are often created to gather credit card...

Cybercriminals Target Kodi Media Player for Malware Distribution

The Kodi media player has emerged as a malware distribution platform for cybercriminals, recently becoming the target for a cryptomining campaign that compromised about 5,000 machines before being thwarted. Those victims are still at risk, researchers warned. Kodi is free and open-source, and can...

Threat Outbreak Alert RuleID33315: Email Messages Distributing Malicious Software on August 13, 2018

Medium Alert ID: 58700 First Published: 2018 August 14 19:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33315 may contain the following files: Name |...

Snapchat: Domain Takeover in [obviousengine.com] a snapchat acquisitions

Hello, Summary while searching in snapchat acquisitions i found obviousengine moe information here https://www.crunchbase.com/organization/obvious-engineeringsection-overview and i found that it's pointing to Github page so i claimed it POC - when i visit it was look like F331040 - i successfully...

Threat Outbreak Alert RuleID32908: Email Messages Distributing Malicious Software on June 21, 2018

Medium Alert ID: 58252 First Published: 2018 June 21 19:56 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32908 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID32987: Email Messages Distributing Malicious Software on June 18, 2018

Medium Alert ID: 58222 First Published: 2018 June 18 13:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32987 may contain the following files: Name | Siz...

13 Ways Cyber Criminals Spread Malware

By David Balaban Security incidents where hackers distribute malicious code malware via spam, This is a post from HackRead.com Read the original post: 13 Ways Cyber Criminals Spread Malware...

Threat Outbreak Alert RuleID32970: Email Messages Distributing Malicious Software on June 14, 2018

Medium Alert ID: 58178 First Published: 2018 June 14 13:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32970 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID32900: Email Messages Distributing Malicious Software on June 7, 2018

Medium Alert ID: 58056 First Published: 2018 June 7 20:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32900 may contain the following files: Name | Size...

GandCrab Ransomware Found Hiding on Legitimate Websites

The GandCrab ransomware continues to virulently spread and adapt to shifting cyber-conditions, most recently crawling back into relevance on the back of several large-scale spam campaigns. What’s interesting is that GandCrab payload was found hiding on legitimate but compromised websites. These,...

Enhancing Office 365 Advanced Threat Protection with detonation-based heuristics and machine learning

Email, coupled with reliable social engineering techniques, continues to be one of the primary entry points for credential phishing, targeted attacks, and commodity malware like ransomware and, increasingly in the last few months, cryptocurrency miners. Office 365 Advanced Threat Protection ATP...

Gandcrab Ransomware Walks its Way onto Compromised Sites

This blog post authored by Nick Biasini with contributions from Nick Lister and Christopher Marczewski. Despite the recent decline in the prevalence of ransomware in the threat landscape, Cisco Talos has been monitoring the now widely distributed ransomware called Gandcrab. Gandcrab uses both...

Universal Plug and Play (UPnP): What you need to know

Universal Plug and Play UPnP is a widely used protocol with a decade-long history of flawed implementations across a wide range of consumer devices. In this paper, we will cover how these aws are still present on devices, how these vulnerabilities are actively being abused, and how a...

Threat Outbreak Alert RuleID32357: Email Messages Distributing Malicious Software on April 2, 2018

Medium Alert ID: 57312 First Published: 2018 April 2 18:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32357 may contain the following files: Name | Siz...