Monthly Archives:: October 2012


Nuclear Exploit Pack goes 2.0

by

In times when the market leading Black Hole Exploit Kit continues to gain market share, competing products are prone to emerge. What is the competition up to? Has it managed to differentiate itself from the market leading product or is it basically a “me too” exploit kit lacking any significant features worth emphasizing on? In this post, I’ll profile the recently advertised Nuclear Exploit Pack v.2.0, elaborate on its features, and discuss whether or not it has the potential to outpace the market leader (Black Hole Exploit Kit) in terms of market share. More details:

Continue Reading »

Cybercriminals spamvertise millions of bogus Facebook notifications, serve malware

by

Recently, cybercriminals spamvertised yet another massive email campaign, impersonating the world’s most popular social network – Facebook. It was similar to a previously profiled spam campaign imitating Facebook. However, in this case the cybercriminals behind it relied on attached malicious archives, compared to including exploits and malware serving links in the email. More details:

Continue Reading »

Cybercriminals spamvertise millions of British Airways themed e-ticket receipts, serve malware

by

Cybercrimianals are currently mass mailing millions of emails in an attempt to trick British Airways customers into executing the malicious attachment found in the spamvertised emails. Upon execution, the malware opens a backdoor on the infected host, allowing the cybercriminals behind the campaign to gain complete control over the infected host. More details:

Continue Reading »

Spamvertised ‘BT Business Direct Order’ themed emails lead to malware

by

Over the past 24 hours, cybercriminals have been spamvertising millions of emails targeting customers of BT’s Business Direct in an attempt to trick its users into executing the malicious attachment found in the emails. Upon executing it, the malware opens a backdoor on the infected host, allowing the cybercriminals behind the campaign to gain complete access to the affected host. More details:

Continue Reading »

Cybercriminals impersonate Verizon Wireless, serve client-side exploits and malware

by

Verizon Wireless customers, beware! For over a week now, cybercriminals have been persistently spamvertising millions of emails impersonating the company, in an attempt to trick current and prospective customers into clicking on the client-side exploits and malware serving links found in the malicious email. Upon clicking on any of the links, users are exposed to the client-side exploits served by the latest version of the Black Hole Exploit Kit. More details:

Continue Reading »

RSA Conference Europe 2012 – recap

by

As many of you know, Webroot recently attended Europe’s most prestigious security conference, RSA Europe 2012, where I held a presentation on the topic of “Cyber Jihad vs Cyberterrorism – Separating Hype from Reality“. Since a picture is worth a thousand words, here are some photos from this year’s RSA Europe conference:

Continue Reading »

Bogus Skype ‘Password successfully changed’ notifications lead to malware

by

Skype users, beware! Cybercriminals are currently spamvertising millions of emails impersonating Skype, in an attempt to trick Skype users that their password has been successfully changed, and that in order to view their call history and change their account settings, they would need to execute the malicious attachment found in the emails. More details:

Continue Reading »

‘Your UPS Invoice is Ready’ themed emails serve malware

by

Over the past 24 hours, cybercriminals launched yet another massive spam campaign, impersonating the United Parcel Service (UPS), in an attempt to trick its current and prospective customers into downloading and executing the malicious attachment found in the email. Upon execution, the malware opens a backdoor on the infected host, allowing the cybercriminals behind the campaign to gain complete control over the victim’s host. More details:

Continue Reading »

Cybercriminals impersonate Delta Airlines, serve malware

by

Following the recently launched malicious campaigns impersonating KLM and American Airlines, cybercriminals are once again busy impersonating yet another company, this time it’s Delta Airlines. More details:

Continue Reading »

PayPal ‘Notification of payment received’ themed emails serve malware

by

Sticking to their proven tactic of systematically rotating the impersonated brands, cybercriminals are currently spamvertising millions of emails impersonating PayPal, in an attempt to trick its users into downloading and executing the malicious attachment found in the legitimate looking email. More details:

Continue Reading »