VB2018 paper: Now you see it, now you don't: wipers in the wild
Posted by on Nov 1, 2018
Early computer viruses were often destructive in nature, but once criminals learned about the money they could make from malware, they realised that destructiveness hurt their goals. Destructive malware, however, has made a comeback in recent years, most importantly in nation-sponsored attacks.
Some of these malware variants literally wipe all data off disks (hence the name 'wiper'), while others merely encrypt the data in a way that doesn't allow for recovery, often masquerading as ransomware: the notorious 2017 attacks of WannaCry and NotPetya are examples of the latter.
In a paper presented at VB2018 in Montreal last month, BAE Systems researcher Saher Naumaan looked at the various kinds of malware that contain a wiper variant, including their goals, propagation methods, and how the wiper functionality worked.
Major targeted attacks employing wipers and classifications.
We have now published Saher's paper in both HTML and PDF format. We have also uploaded the video of her presentation to our YouTube channel.
OpSec mistakes are what lead to many malware discoveries, and in the case of the Geost Android botnet the mistake was a really interesting one. Today we publish the VB2019 paper by Sebastian García, Maria Jose Erquiaga and Anna Shirokova on the Geost…
On Monday, the infamous Emotet malware resumed its spam campaign to spread the latest version of the malware. As before, the malware successfully bypasses many email security products.