VB Blog

VB2021 localhost call for papers: a great opportunity

Posted by   Virus Bulletin on   Mar 17, 2021

VB2021 localhost presents an exciting opportunity to share your research with an even wider cross section of the IT security community around the world than usual, without having to take time out of your work schedule (or budget) to travel.

Read more  

New article: Excel Formula/Macro in .xlsb?

Posted by   Virus Bulletin on   Mar 2, 2021

In a follow-up to an article published last week, Kurt Natvig takes us through the analysis of a new malicious sample using the .xlsb file format.

Read more  

New article: Decompiling Excel Formula (XF) 4.0 malware

Posted by   Virus Bulletin on   Feb 23, 2021

In a new article, researcher Kurt Natvig takes a close look at XF 4.0 malware.

Read more  

The Bagsu banker case - presentation

Posted by   Virus Bulletin on   Jan 29, 2021

At VB2019, CSIS researcher Benoît Ancel spoke about a quiet banking trojan actor that has been targeting German users since at least 2014.

Read more  

VB2021 call for papers - now open, to all!

Posted by   Virus Bulletin on   Jan 19, 2021

The call for papers for VB2021 is now open and we want to hear from you - we're planning for flexible presentation formats, so everyone is encouraged to submit, regardless of whether or not you know at this stage whether you'll be able to travel to Prague!

Read more  

In memoriam: Yonathan Klijnsma

Posted by   Virus Bulletin on   Jan 11, 2021

We were very sorry to learn of the passing of researcher Yonathan Klijnsma last week. Here, former VB Editor Martijn Grooten shares his memories of a talented researcher and a very kind person: this month, infosec lost a really good one.

Read more  

VB2020 localhost videos available on YouTube

Posted by   Virus Bulletin on   Jan 8, 2021

VB has made all VB2020 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

Read more  

VB2020 presentation & paper: 2030: backcasting the potential rise and fall of cyber threat intelligence

Posted by   Virus Bulletin on   Dec 8, 2020

At VB2020 localhost, threat intelligence consultant Jamie Collier used the analytical technique of backcasting to look at the rise and fall of the cyber threat intelligence industry.

Read more  

VB2020 presentation: Behind the Black Mirror: simulating attacks with mock C2 servers

Posted by   Virus Bulletin on   Dec 4, 2020

At VB2020 localhost, Carbon Black's Scott Knight presented an approach he and his colleagues have taken to more realistically simulate malware attacks.

Read more  

VB2020 presentation & paper: Advanced Pasta Threat: mapping threat actor usage of open-source offensive security tools

Posted by   Virus Bulletin on   Dec 2, 2020

At VB2020, researcher Paul Litvak revealed how he put together a comprehensive map of threat actor use of open-source offensive security tools.

Read more  

Search blog

New peer-to-peer botnet discovered

New botnet shares fast flux DNS and other similarities with Storm and Waledac.
New botnet shares fast flux DNS and other similarities with Storm and Waledac. In the last few days of 2010, security researchers discovered a new botnet that shares many… https://www.virusbulletin.com/blog/2011/01/new-peer-peer-botnet-discovered/

Valentine's lures lead to infection

Predicted spate of romance hooks under way.
Predicted spate of romance hooks under way. After numerous security watchers predicted a barrage of phishing and malware attacks associated with Valentine's Day this week, the… https://www.virusbulletin.com/blog/2009/02/valentine-s-lures-lead-infection/

Researchers crack into Storm botnet

Comms channels decrypted, automated removal possible.
Comms channels decrypted, automated removal possible. A group of German academics claim to have deciphered communications protocols used by the infamous 'Storm' botnet, allowing… https://www.virusbulletin.com/blog/2009/01/researchers-crack-storm-botnet/

Riders on a Storm

Researchers hijack botnet - and find spam success rates lower than previously believed.
Researchers hijack botnet - and find spam success rates lower than previously believed. Less than 1 in 12 million spam emails sent through the infamous Storm botnet led to a… https://www.virusbulletin.com/blog/2008/11/riders-storm/

Storm mails bring spoof World War 3 news

US-Iran war story used as hook for malware barrage.
US-Iran war story used as hook for malware barrage. The Storm botnet has been spamming in force again in the past week, with its expected run targeting 4th of July celebrations in… https://www.virusbulletin.com/blog/2008/07/storm-mails-bring-spoof-world-war-3-news/

'Kraken' monster botnet causing controversy

As latest botnet scare debated, Storm keeps on blowing.
As latest botnet scare debated, Storm keeps on blowing. Recent reports of a massive botnet, apparently sneaking its trojans past security software and far outnumbering better-known… https://www.virusbulletin.com/blog/2008/04/kraken-monster-botnet-causing-controversy/

HP ships infected USB keys

Autorun worms found on batch of server setup devices.
Autorun worms found on batch of server setup devices. A batch of USB thumb drives containing software intended to assist in the setup of servers have been found to contain some… https://www.virusbulletin.com/blog/2008/04/hp-ships-infected-usb-keys/

Google Groups and Blogspot used to serve malware

Company finds own IP address to be serving most malware.
Company finds own IP address to be serving most malware.Malware writers have created thousands of Google Groups with the sole purpose of serving malware, Sunbelt reports. On the… https://www.virusbulletin.com/blog/2008/04/google-groups-and-blogspot-used-serve-malware/

April Storm

April Fools' Day emails contain new variant of infamous worm.
April Fools' Day emails contain new variant of infamous worm. Security researchers report a new wave of spam emails being sent out. The emails, which use subject lines such as… https://www.virusbulletin.com/blog/2008/04/april-storm/

Storm Valentines run under way

Seasonal spam and malware barrage gets going.
Seasonal spam and malware barrage gets going. The expected run of 'Storm' spams, pushing links to their latest line of malware disguised as Valentine's messages, has begun, with… https://www.virusbulletin.com/blog/2008/02/storm-valentines-run-under-way/

Stormy love letters

Storm botnet celebrates birthday with new wave of spam.
Storm botnet celebrates birthday with new wave of spam. Earlier this week malware experts warned of likely increased activity of the Storm botnet around Valentine's Day next month.… https://www.virusbulletin.com/blog/2008/01/stormy-love-letters/

Phishing danger increases as Storm botnet is hired out

Smart new trojan and Storm diversification add to online banking risk.
Smart new trojan and Storm diversification add to online banking risk. The dangers of banking online grew significantly in past weeks, as portions of the ever-expanding Storm… https://www.virusbulletin.com/blog/2008/01/phishing-danger-increases-storm-botnet-hired-out/

Usual fare for holiday season

Storm ecards and social site spyware mark unsurprising year end.
Storm ecards and social site spyware mark unsurprising year end. With large portions of the globe celebrating various festivals over the past few weeks, an expected upsurge in… https://www.virusbulletin.com/blog/2008/01/usual-fare-holiday-season/

Russian Business Network leaves Russia

Leading cybercrime hosting hub moves business to fresh pastures.
Leading cybercrime hosting hub moves business to fresh pastures. The notorious Russian Business Network (RBN), recently making headlines for the massive amounts of malicious and… https://www.virusbulletin.com/blog/2007/11/russian-business-network-leaves-russia/

Storm spams promise spooky Halloween

Tricks not treats as skeleton game emails link to attack.
Tricks not treats as skeleton game emails link to attack. The 'Storm' attack has once again taken advantage of a popular cultural occasion to spam out the latest wave of links to… https://www.virusbulletin.com/blog/2007/10/storm-spams-promise-spooky-halloween/

Storm botnet evolution hints at spam and DDoS renting

Latest change in tactics could mean zombie clusters for hire.
Latest change in tactics could mean zombie clusters for hire. The latest twist in the long-running 'Storm' saga, the use of encryption in communications between infected hosts and… https://www.virusbulletin.com/blog/2007/10/storm-botnet-evolution-hints-spam-and-ddos-renting/

Storm attack strikes back

Cute kitten cards cover latest wave of malware.
Cute kitten cards cover latest wave of malware. The Storm attack has returned with yet another wave of blended attacks, with links to the drive-by download sites of the initial… https://www.virusbulletin.com/blog/2007/10/storm-attack-strikes-back/

Storm DDoS hits anti-scam sites

419 fighters attacked - NFL and TOR latest spam hooks.
419 fighters attacked - NFL and TOR latest spam hooks. The massive botnet amassed by the 'Storm' (Zhelatin/Nuwar/Dorf/etc.) attack continues to target new victims, with the TOR… https://www.virusbulletin.com/blog/2007/09/storm-ddos-hits-anti-scam-sites/

YouTube latest Storm hook

Fake video links aim to pull in yet more victims.
Fake video links aim to pull in yet more victims. The never-ending stream of 'Storm' attacks continued over the weekend with a new tactic - the latest spammed email campaign… https://www.virusbulletin.com/blog/2007/08/youtube-latest-storm-hook/

Latest Storm barrage offers site memberships

New tactic provides logins to special-interest sites.
New tactic provides logins to special-interest sites. The 'Storm' attack has changed tactic yet again, with the latest set of spams providing login details to a wide selection of… https://www.virusbulletin.com/blog/2007/08/latest-storm-barrage-offers-site-memberships/

« Previous 12 Next »

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.