Found 87 bookmarks
Custom sorting
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
During routine detection maintenance, our Mac researchers stumbled upon a small set of files with backdoor capabilities that seem to form part of a more complex malware toolkit. The following analysis is incomplete, as we are trying to identify the puzzle pieces that are still missing.
#bitdefender#EN#2023#macOS#malware#Cross-Platform#Backdoor
·bitdefender.com·
Fragments of Cross-Platform Backdoor Hint at Larger Mac OS Attack
Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack | Securelist
Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack | Securelist
A DLL named guard64.dll, which was loaded into the infected 3CXDesktopApp.exe process, was used in recent deployments of a backdoor that we dubbed “Gopuram” and had been tracking internally since 2020.
#securelist#APT#Backdoor#Data-theft#Lazarus#Malware-Descriptions#Gopuram#guard64.dll#3CX
·securelist.com·
Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack | Securelist
A Backdoor with Smart Screenshot Capability
A Backdoor with Smart Screenshot Capability
Today, everything is “smart” or “intelligent”. We have smartphones, smart cars, smart doorbells, etc. Being "smart" means performing actions depending on the context, the environment, or user actions. For a while, backdoors and trojans have implemented screenshot capabilities. From an attacker’s point of view, it’s interesting to “see” what’s displayed on the victim’s computer.
#sans#EN#2023#python#backdoor#Screenshot
·isc.sans.edu·
A Backdoor with Smart Screenshot Capability
From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind
From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind
A new variant of the URSNIF malware, first observed in June 2022, marks an important milestone for the tool. Unlike previous iterations of URSNIF, this new variant, dubbed LDR4, is not a banker, but a generic backdoor (similar to the short-lived SAIGON variant), which may have been purposely built to enable operations like ransomware and data theft extortion. This is a significant shift from the malware’s original purpose to enable banking fraud, but is consistent with the broader threat landscape.
#mandiant#EN#2022#URSNIF#backdoor#Banking#malware#Gozi#CUTWAIL#spam
·mandiant.com·
From RM3 to LDR4: URSNIF Leaves Banking Fraud Behind
TA505 Hackers Using TeslaGun Panel to Manage ServHelper Backdoor Attacks
TA505 Hackers Using TeslaGun Panel to Manage ServHelper Backdoor Attacks
Cybersecurity researchers have offered insight into a previously undocumented software control panel used by a financially motivated threat group known as TA505. "The group frequently changes its malware attack strategies in response to global cybercrime trends," Swiss cybersecurity firm PRODAFT said in a report shared with The Hacker News. "It opportunistically adopts new technologies in order to gain leverage over victims before the wider cybersecurity industry catches on."
#thehackernews#EN#2022#PRODAFT#TeslaGun#ServHelper#Backdoor#Analysis
·thehackernews.com·
TA505 Hackers Using TeslaGun Panel to Manage ServHelper Backdoor Attacks
SeaFlower 藏海花 A backdoor targeting iOS web3 wallets
SeaFlower 藏海花 A backdoor targeting iOS web3 wallets
Confiant monitors 2.5+ billion ads per day via 110+ integrations in the advertising stack. This provides great visibility on malicious activity infiltrating the ad stack and the broader Internet. And that includes all the web3 malicious activity funneling thru it. The variety and the range of our detection enable Confiant to detect unique malicious activity as soon as it surfaces. SeaFlower is an example of this unique cluster of malicious activities targeting web3 wallet users that we will document in this blog post.
#objective-see#EN#2022#web3#iOS#backdoor#wallet#SeaFlower
·objective-see.org·
SeaFlower 藏海花 A backdoor targeting iOS web3 wallets
New Malware Capable of Controlling Social Media Accounts Infects 5,000+ Machines and is actively being Distributed via Gaming Applications on Microsoft's Official Store
New Malware Capable of Controlling Social Media Accounts Infects 5,000+ Machines and is actively being Distributed via Gaming Applications on Microsoft's Official Store
New Malware Capable of Controlling Social Media Accounts Infects 5,000+ Machines and is actively being Distributed via Gaming Applications on Microsoft’s Official Store
#checkpoint#2022#Microsoft#sore#app#electron#socialmedia#TempleRun#backdoor#games
·research.checkpoint.com·
New Malware Capable of Controlling Social Media Accounts Infects 5,000+ Machines and is actively being Distributed via Gaming Applications on Microsoft's Official Store