CVE-2012-1723

A recently flagged phishing campaign aimed at delivering the Agent Tesla RAT to unsuspecting users takes advantage of old vulnerabilities in Microsoft Office that allow remote code execution. “Despite fixes for CVE-2017-11882/CVE-2018-0802 being released by Microsoft in November, 2017 and January, 2018, this vulnerability remains popular amongst threat actors, suggesting there are still unpatched devices in the wild, even after over five years,” says Fortinet researcher Xiaopeng Zhang. “We are observing and mitigating 3000 attacks … More →

The function of cybersecurity is not to eliminate all attacks and compromises – that’s impossible – but to make the attack so expensive and time-consuming on the attacker that he simply moves on to an easier target. That is the purpose of a new product/service designed to make commodity ransomware attacks less easy for the attacker.

What is old may not always be new, but when it comes to hacking, it’s still effective.

Turla, also known as Snake or Uroburos is one of the most sophisticated ongoing cyber-espionage campaigns. When the first research on Turla/Snake/Uroburos was published, it didn’t answer one major question: how do victims get infected? The latest Kaspersky Lab research on this operation reveals that Epic is the initial stage of the Turla victim infection mechanism. The “Epic” project has been used since at least 2012, with the highest volume of activity observed in January-February … More →

Facebook has removed a scam that was redirecting users to the Nuclear exploit kit, according to researchers with Symantec. The scam relied on users getting drawn into clicking on a link promoting a work-from-home opportunity with the headline: ‘EXPOSED: Mom Makes $8,000/Month and You Won’t Believe How She Does It!’

Antivirus, Patch Management Failures Open Doors to Cyberattacks Patch management and antivirus are meant to prevent attackers cutting their way into the vaults protecting enterprise data.

Security experts uncovered an unusual cyber espionage campaign based on file infector belonging to the PE_EXPIRO family that includes information theft module Security experts at TrendMicro uncovered an unusual espionage campaign that hit United States users based on malware having file infector with stealing capabilities. The attackers acted with specific intent to steal information from organizations or […]

An unusual attack has been spotted in the wild, using an unexpected combination of threats. This attack used exploit kits (in particular Java and PDF exploits) to deliver file infectors onto vulnerable systems. Interestingly, these file infectors have information theft routines, which is a behavior not usually found among file infectors. These malware are part of PE_EXPIRO family, file infectors that was first spotted spotted in 2010. In addition to standard file infection routines, the … More →

Researchers from Trend Micro have discovered a new attack that leverages a combination of exploits to infect systems and target FTP credentials and other information on Windows-based systems. The threat is a file infector malware that is part of the PE_EXPIRO family; malware that Trend says was first discovered in 2010.

A new version of a file-infecting malware program that’s being distributed through drive-by download attacks is also capable of stealing FTP (File Transfer Protocol) credentials, according to security researchers from antivirus firm Trend Micro. The newly discovered variant is part of the PE_EXPIRO family of file infectors that was identified in 2010, the Trend Micro […]

A new version of the Java exploit kit g01pack has added a second stage to the exploit process in order to bypass detection by antivirus tools, Trusteer’s researchers said. The kit has an infection rate estimated at about 1 out of 3,000 machines a month.

Most drive-by exploit kits use a minimal exploit shellcode that downloads and runs the final payload. This is akin to a two-stage ICBM (InterContinental Ballistic Missile) where the first stage, the exploit, puts the rocket in its trajectory and the second stage, the payload, inflicts the damage. In the cybercrime world, the de-coupling of the first stage from the payload is designed to make sure that an exploit kit is as generic as possible and … More →

Exploit Kit authors must really love Java . Not only is it ripe with vulnerabilities but its own language provides a…

Java exploits have become popular additions to many crimeware kits for good reason. According to Websense, close to 94 percent of endpoints running Oracle Java are vulnerable to at least one Java exploit.

Researchers at AlienVault shed some light on the evolution of the Sykipot malware attacks. The Sykipot attacks have exploited a number of zero-days during the past few years, including vulnerabilities affecting Adobe Reader, Adobe Flash Player and Microsoft Internet Explorer.

Ransomware is still going strong and infecting countless PCs. We happened to stumble upon an interesting sample part of the Urausy…

Webroot’s Dancho Danchev is known for combing through the wilds of the Internet for places where cyber criminals congregate and reporting back with interesting news about tools and services offered for sale. Among those is a brand new exploit kit that, for now, concentrates only on exploiting Java flaws. The vulnerabilities in questions are CVE-2012-1723 and CVE-2013-0431, but more exploits are to be added soon, say its creators. Cyber crooks can rent the kit for … More →

Exploit kit, a name which has become depressingly familiar, crimaware kit that contains malicious code to exploit principal vulnerabilities in large consume product such as browsers, last news is that a new kit named Whitehole has emerged on the underground market. Generally the exploit kits are malicious Web-based applications designed to install malware on computers […]

The name BlackHole looms large over the marketplace for crimeware kits, but a new player is said to have emerged with similar code and a similar name.

A new exploit kit called Whitehole has emerged on the underground market, providing cybercriminals with one more tool to infect computers with malware over the Web, security researchers from antivirus vendor Trend Micro reported Wednesday. Exploit kits are malicious Web-based applications designed to install malware on computers by exploiting vulnerabilities in outdated browser plug-ins like […]

The latest Java vulnerability has been integrated into both Black Hole and Gong Da exploit kits, making it easier for cyber-criminals to launch attacks exploiting the flaw, a security researcher said.

Criminals are sending malicious emails that purport to come from payroll services firms in order to infect with malware the computers of payroll administrators from various companies, according to researchers from the SANS Internet Storm Center (ISC). “For the past couple of weeks, companies that offer outsourced payroll management services have seen their name being […]

The minds behind the Blackhole exploit toolkit have updated it with an exploit targeting a recently patched vulnerability in Java.