by Blog Staff | Feb 10, 2012 | Industry Intel, Threat Lab
What are pharmaceutical scammers up to? From active participation in black hat search engine optimization campaigns, to spamvertising of bogus links — including QR Codes — and compromising of web sites with high page rank in order to redirect to pharmaceutical scams, scammers are keeping themselves pretty busy in order to monetize as much web traffic as possible.
Recently, one of the most popular affiliate network for selling counterfeit pharmaceutical items launched its own Web contest.
Let’s take a look.
(more…)
by Blog Staff | Feb 8, 2012 | Industry Intel, Threat Lab
Security researchers from Webroot have intercepted two currently live client-side exploits serving malware campaigns that have already managed to infect over 20,000 PCs across the globe, primarily in the United States. Based upon detailed analysis, it can be concluded that both campaigns are launched by the same cybercriminal.
More details:
(more…)
by Blog Staff | Feb 8, 2012 | Industry Intel, Threat Lab
Security researchers from “Tracking Cyber Crime” have spotted a new ZeuS crimeware variant, that’s based on the leaked ZeuS source code from last year.
Dubbed Citadel, the crimeware is positioned as a universal spyware system, whose modular nature allows cybercriminals to offer flexibly priced value-added services such as managed malware crypting, and managed web injects as a service.
Some of Citadel’s core features include:
(more…)
by Blog Staff | Feb 3, 2012 | Industry Intel, Threat Lab
The competitive arms race between security vendors and malicious cybercriminals constantly produces new defensive mechanisms, next to new attack platforms and malicious tools aiming to efficiently exploit and infect as many people as possible.
Continuing the “A peek inside…” series, in this post I will profile yet another malware loader. This time it’s the Smoke Malware Loader.
(more…)
by Blog Staff | Feb 2, 2012 | Industry Intel, Threat Lab
A currently spamvertised spam campaign is redirecting users to pharmaceutical scams, in an attempt to trick them into purchasing counterfeit pharmaceutical items.
More details:
(more…)
by Blog Staff | Feb 1, 2012 | Industry Intel, Threat Lab
Who needs automated bots solving CAPTCHAs, when you have teams of low-waged humans recognizing them for pennies?
In an underground cybercrime ecosystem dominated by managed services and countless outsourcing opportunities, it’s fairly logical to assume that Google’s reCAPTCHA is under constant fire.
Just how easy is it to recognize reCAPTCHA images for malicious account registration and service abuse purposes? Let’s find out.
(more…)
by Blog Staff | Jan 30, 2012 | Industry Intel, Threat Lab
Who said there’s such a thing as a trusted Java applet?
In situations where malicious attackers cannot directly exploit client-side vulnerabilities on the targeted host, they will turn to social engineering tricks, like legitimate-looking Java Applets, which will on the other hand silently download the malicious payload of the attacker, once the user confirms he trusts the Applet.
Let’s profile a DIY (do-it-yourself) malicious Java Applet generator currently available for download at selected cybercrime-friendly online communities:
(more…)
by Blog Staff | Jan 29, 2012 | Industry Intel, Threat Lab
Cisco Systems, recently announced the release of ‘Cisco Global Threat Report’ for 4Q11, containing threat intelligence based on Cisco’s observation of the malicious threat landscape.
Key summary points:
(more…)
by Blog Staff | Jan 26, 2012 | Industry Intel, Threat Lab
Participants in the dynamic cybercrime underground ecosystem are constantly working on new cybercrime-friendly releases in the form of malware bots, Remote Access Tools (RATs) and malware loaders.
Continuing the “A peek inside…” series, in this post I will profile yet another DIY (do-it-yourself) malware bot, available at the disposal of cybercriminals at selected cybercrime-friendly online communities.
(more…)
by Blog Staff | Jan 25, 2012 | Industry Intel, Threat Lab
Security researchers from Webroot have intercepted a currently active, client-side exploits-serving malicious campaign that has already managed to infect 18,544 computers across the globe, through the BlackHole web malware exploitation kit.
More details:
(more…)
