A Modern Hypervisor as a Basis for a Sandbox
In the field of information security, sandboxes are used to isolate an insecure external environment from a secure internal environment (or vice versa), to protect against the exploitation of vulnerabilities, and to analyze malicious code. At Kaspersky Lab, we have several sandboxes, we will look at just one of them that was customized to serve the needs of a specific product and became the basis of Kaspersky Anti Targeted Attack Platform.
Source: https://securelist.com/a-modern-hypervisor-as-a-basis-for-a-sandbox/81902/
An (un)documented Word feature abused by attackers
A little while back we were investigating the malicious activities of the Freakyshelly targeted attack and came across spear phishing emails that had some interesting documents attached to them. They were in OLE2 format and contained no macros, exploits or any other active content.
Source: https://securelist.com/an-undocumented-word-feature-abused-by-attackers/81899/
Connected Medicine and Its Diagnosis
Results that had been obtained during research that we discussed in a previous article called for a more detailed analysis of the security problem, but now from within medical institutions (with the consent of their owners, of course). The analysis allowed us to work on mistakes and give a series of recommendations for IT experts who service medical infrastructure.
Source: https://securelist.com/connected-medicine-and-its-diagnosis/81857/
Miners on the Rise
Over the last month alone, we have detected several large botnets designed to profit from concealed crypto mining. We have also observed growing numbers of attempts to install miners on servers owned by organizations. When these attempts are successful, the companies’ business processes suffer because data processing speeds fall substantially.
Source: https://securelist.com/miners-on-the-rise/81706/
Satoshi Bomb
Let us discuss what defines the profitability of bitcoin mining, what principles for mining speed adaptation were initially embedded into it, and why these principles can lead to the failure of the cryptocurrency in the long run.
Source: https://securelist.com/satoshi-bomb/81820/
Dissecting the Chrome Extension Facebook malware
The Facebook malware that spread last week was dissected in a collaboration with Kaspersky Lab and Detectify. We were able to get help from the involved companies and cloud services to quickly shut down parts of the attack to mitigate it as fast as possible.
Source: https://securelist.com/dissecting-the-chrome-extension-facebook-malware/81716/
Introducing WhiteBear
As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting APT activity that we called WhiteBear. It is a parallel project or second stage of the Skipper Turla cluster of activity documented in another private report. Like previous Turla activity, WhiteBear leverages compromised websites and hijacked satellite connections for command and control (C2) infrastructure.
Source: https://securelist.com/introducing-whitebear/81638/
Jimmy Nukebot: from Neutrino with love
In one of our previous articles, we analyzed the NeutrinoPOS banker as an example of a constantly evolving malware family. A week after publication, this Neutrino modification delivered up a new malicious program classified by Kaspersky Lab as Trojan-Banker.Win32.Jimmy.
Source: https://securelist.com/jimmy-nukebot-from-neutrino-with-love/81667/
Neutralization reaction
Corporate information security services often turn out to be unprepared: their employees underestimate the speed, secrecy and efficiency of modern cyberattacks and do not recognize how ineffective the old approaches to security are. And if there is no clear understanding of what sort of incident it is, an attack cannot be repelled. We hope that our recommendations about identifying incidents and responding to them will help information security specialists create a solid foundation for reliable multi-level business protection.
Source: https://securelist.com/neutralization-reaction/81620/
WAP-billing Trojan-Clickers on rise
During the preparation of the “IT threat evolution Q2 2017” report I found several common Trojans that were stealing money from users using WAP-billing. We hadn’t seen any Trojans like this in a while, but several of them appeared out of nowhere. Most of them had been under development since the end of 2016 / the beginning of 2017, but their prevalence increased only in the second half of Q2 2017. Therefore, I decided to take a closer look at these Trojans.
Source: https://securelist.com/wap-billing-trojan-clickers-on-rise/81576/
Source: https://securelist.com/