Category Archives: exploit kit

Betabot steals passwords, downloads ransomware

Posted on by

The infamous and ever-changing Betabot information-stealing Trojan is back again, and has been observed downloading another well-known threat – the Cerber ransomware. Of course, before doing that, Betabot does its own routine, and slurps all passwords stored in all local browsers. Weaponized resumes According to Patrick Belcher, Senior Director of Threat Research at Invincea, Betabot was first being delivered to unsuspecting users via the Neutrino Exploit Kit. Lately, though, the meticulous crooks behind this scheme … More → Continue reading Betabot steals passwords, downloads ransomware→

Inside the Demise of the Angler Exploit Kit

Posted on by

Researchers at Kaspersky Lab today confirmed that the cybercriminals behind the Lurk Trojan were also responsible for the development and distribution of the Angler Exploit Kit Continue reading Inside the Demise of the Angler Exploit Kit→

Innovative techniques allow malvertising campaigns to run for years

Posted on by

A threat actor dubbed AdGholas has been mounting successful malvertising campaigns by using innovative targeting and obfuscation techniques, and has been infecting thousands of victims every day since 2015 – and possibly even earlier. The discovery of the massive malvertising network was made by Proofpoint researchers, and Trend Micro’s researchers helped with some aspects. Their efforts, along with those of advertising network operators, resulted in the suspension of all AdGholas campaigns on July 20, 2016. … More → Continue reading Innovative techniques allow malvertising campaigns to run for years→

Slew of WP-based business sites compromised to lead to ransomware

Posted on by

If an approach works well, there is no reason to change tack, and the masters of the SoakSoak botnet are obviously of the same belief. A year and a half after they have been spotted compromising WP-based websites through vulnerabilities in the Slider Revolution (“RevSlider”) plugin and redirecting visitors to the malware-laden SoakSoak.ru website, they are at it again. “Websites are often compromised by botnets that scan websites for vulnerable software or application plugins,” Invincea’s … More → Continue reading Slew of WP-based business sites compromised to lead to ransomware→

Compromised Joomla sites are foisting ransomware on visitors

Posted on by

Administrators of WP and Joomla sites would do well to check for specific fake analytics code injected into their properties, as a ransomware delivery campaign taking advantage of vulnerable sites has been going strong for over a month now. Sucuri researchers began warning about the “Realstatistics” malware campaign two weeks ago, and dated it back to June 6 (at least). The name of the campaign was derived from the name of the domains used by … More → Continue reading Compromised Joomla sites are foisting ransomware on visitors→

Neutrino EK picks up momentum in recent attacks

Posted on by

The Neutrino developers have made some changes to the landing page source code as well as integrated a new exploit. The malware campaigns that once were Angler’s continue to point to Neutrino including a large malvertising attack on top adult sites we … Continue reading Neutrino EK picks up momentum in recent attacks→

Popular Anime Site Infected, Redirecting to Exploit Kit, Ransomware

Posted on by

Jkanime, a popular site that streams anime videos, has been infected with malware that redirects to the Neutrino Exploit Kit and CryptXXX ransomware infections. Continue reading Popular Anime Site Infected, Redirecting to Exploit Kit, Ransomware→

News Flash: the “Ohdear­notagain” vulnerability [Chet Chat Podcast 242]

Posted on by

Enjoy our latest podcast with Sophos experts John Shier and Paul Ducklin as they take wittily serious aim at the latest security news. Continue reading News Flash: the “Ohdear­notagain” vulnerability [Chet Chat Podcast 242]→