Threat Research

It’s what we do.

A peek inside the Smoke Malware Loader

February 3, 2012By Dancho Danchev

The competitive arms race between security vendors and malicious cybercriminals constantly produces new defensive mechanisms, next to new attack platforms and malicious tools aiming to efficiently exploit and infect as many people as possible….read more

Research: Google’s reCAPTCHA under fire

February 1, 2012By Dancho Danchev

Who needs automated bots solving CAPTCHAs, when you have teams of low-waged humans recognizing them for pennies? In an underground cybercrime ecosystem dominated by managed services and countless outsourcing opportunities, it’s fairly logical…read more

A peek inside the uBot malware bot

January 26, 2012By Dancho Danchev

Participants in the dynamic cybercrime underground ecosystem are constantly working on new cybercrime-friendly releases in the form of malware bots, Remote Access Tools (RATs) and malware loaders. Continuing the “A peek inside…” series,…read more

Researchers intercept a client-side exploits serving malware campaign

January 25, 2012By Dancho Danchev

Security researchers from Webroot have intercepted a currently active, client-side exploits-serving malicious campaign that has already managed to infect 18,544 computers across the globe, through the BlackHole web malware exploitation kit. More details:

How phishers launch phishing attacks

January 23, 2012By Dancho Danchev

Just like in every other industry, participants in the cybercrime ecosystem are no strangers to the concept of standardization. Standardization results in efficiencies, which on the other hand results in economies of scale. In…read more

A peek inside the Umbra malware loader

January 20, 2012By Dancho Danchev

The thriving cybercrime underground marketplace has a lot to offer. From DIY botnet builders, DIY DDoS platforms, to platforms for executing clickjacking and likejacking campaigns, next to drive-by malware attacks, the ecosystem is…read more

A peek inside the Cythosia v2 DDoS Bot

January 9, 2012By Dancho Danchev

by Dancho Danchev With DDoS extortion and DDoS for hire attacks proliferating, next to the ever decreasing price for renting a botnet, it shouldn’t come as a surprise that cybercriminals are constantly experimenting…read more

A peek inside the PickPocket Botnet

January 6, 2012By Dancho Danchev

by Dancho Danchev Malicious attackers quickly adapt to emerging trends, and therefore constantly produce new malicious releases. One of these recently released underground tools, is the PickPocket Botnet, a web-based command and control…read more

Mass SQL injection attack affects over 200,000 URLs

January 5, 2012By Dancho Danchev

by Dancho Danchev Security researchers from the Internet Storm Center, have intercepted a currently ongoing SQL injection attack, that has already affected over 200,000 URLs. The attack was originally detected in early December, 2011….read more