VB Blog

VB2019 paper: Fantastic Information and Where to Find it: A guidebook to open-source OT reconnaissance

Posted by   Martijn Grooten on   Nov 22, 2019

A VB2019 paper by FireEye researcher Daniel Kapellmann Zafra explained how open source intelligence (OSINT) can be used to learn crucial details of the inner workings of many a system. Today we publish Daniel's paper and the recording of his presentation.

Read more  

VB2019 paper: Different ways to cook a crab: GandCrab Ransomware-as-a-Service (RaaS) analysed in depth

Posted by   Martijn Grooten on   Nov 21, 2019

Though active for not much longer than a year, GandCrab had been one of the most successful ransomware operations. In a paper presented at VB2019 in London, McAfee researchers John Fokker and Alexandre Mundo looked at the malware code, its evolution and the affiliate scheme behind it. Today we publish both their paper and the recording of their presentation.

Read more  

VB2019 paper: Domestic Kitten: an Iranian surveillance program

Posted by   Martijn Grooten on   Nov 18, 2019

At VB2019 in London, Check Point researchers Aseel Kayal and Lotem Finkelstein presented a paper detailing an Iranian operation they named 'Domestic Kitten' that used Android apps for targeted surveillance. Today we publish their paper and the video of their presentation.

Read more  

VB2019 video: Discretion in APT: recent APT attack on crypto exchange employees

Posted by   Martijn Grooten on   Nov 18, 2019

At VB2019 in London, LINE's HeungSoo Kang explained how cryptocurrency exchanges had been attacked using Firefox zero-days. Today, we publish the video of his presentation.

Read more  

VB2019 paper: DNS on fire

Posted by   Martijn Grooten on   Nov 7, 2019

In a paper presented at VB2019, Cisco Talos researchers Warren Mercer and Paul Rascagneres looked at two recent attacks against DNS infrastructure: DNSpionage and Sea Turtle. Today we publish their paper and the recording of their presentation.

Read more  

German Dridex spam campaign is unfashionably large

Posted by   Martijn Grooten on   Nov 6, 2019

VB has analysed a malicious spam campaign targeting German-speaking users with obfuscated Excel malware that would likely download Dridex but that mostly stood out through its size.

Read more  

Paper: Dexofuzzy: Android malware similarity clustering method using opcode sequence

Posted by   Martijn Grooten on   Nov 5, 2019

We publish a paper by researchers from ESTsecurity in South Korea, who describe a fuzzy hashing algorithm for clustering Android malware datasets.

Read more  

Emotet continues to bypass many email security products

Posted by   Martijn Grooten on   Nov 4, 2019

Having returned from a summer hiatus, Emotet is back targeting inboxes and, as seen in the VBSpam test lab, doing a better job than most other malicious campaigns at bypassing email security products.

Read more  

VB2019 paper: We need to talk - opening a discussion about ethics in infosec

Posted by   Martijn Grooten on   Nov 1, 2019

Those working in the field of infosec are often faced with ethical dilemmas that are impossible to avoid. Today, we publish a VB2019 paper by Kaspersky researcher Ivan Kwiatkowski looking at ethics in infosec as well as the recording of Ivan's presentation.

Read more  

Stalkerware poses particular challenges to anti-virus products

Posted by   Martijn Grooten on   Oct 31, 2019

Malware used in domestic abuse situations is a growing threat, and the standard way for anti-virus products to handle such malware may not be good enough. But that doesn't mean there isn't an important role for anti-virus to play.

Read more  

Search blog

Botnet rented for online extortion

Man who threatened World Cup bookmakers with DDoS attack convicted.
Man who threatened World Cup bookmakers with DDoS attack convicted. A German man who hired a botnet and used it to threaten bookmakers with DDoS attacks during the 2010 FIFA World… https://www.virusbulletin.com/blog/2011/06/botnet-rented-online-extortion/

Zeus source code leaked

Banking trojan among the most advanced of its kind.
Banking trojan among the most advanced of its kind. Researchers at Danish security firm CSIS have discovered that the full source code of the Zeus crime kit has been leaked to… https://www.virusbulletin.com/blog/2011/05/zeus-source-code-leaked/

Smile, you're on a botnet!

Multi-platform Java botnet allows for remote control of webcam and microphone.
Multi-platform Java botnet allows for remote control of webcam and microphone. Researchers have discovered a multi-platform botnet running on the Java Runtime Environment (JRE)… https://www.virusbulletin.com/blog/2011/05/smile-you-re-botnet/

Department of Justice shuts down Coreflood botnet

'Stop' command sent from replaced command and control servers.
'Stop' command sent from replaced command and control servers. Earlier this week the US Department of Justice (DoJ) obtained an unprecedented temporary restraining order (TRO) that… https://www.virusbulletin.com/blog/2011/04/department-justice-shuts-down-coreflood-botnet/

Cutwail botnet sent 1.7 trillion spam messages

Operators made several million through botnet.
Operators made several million through botnet. Researchers from The Last Line of Defense and universities in Bochum and Santa Barbara have shared some insight into the workings of… https://www.virusbulletin.com/blog/2011/03/cutwail-botnet-sent-1-7-trillion-spam-messages/

Spam levels take a nose dive as Rustock apparently taken down - update

Eerie silence from Rustock botnet. Microsoft reported to have co-ordinated take down.
Eerie silence from Rustock botnet. Microsoft reported to have co-ordinated take down. Spam levels have taken a nose dive over the last 24 hours - apparently as a result of a take… https://www.virusbulletin.com/blog/2011/03/spam-levels-take-nose-dive-rustock-apparently-taken-down-update/

Cybercriminals frustrated with botnet trackers

Drastic measures discussed by users of online forum.
Drastic measures discussed by users of online forum. Russian cybercriminals are willing to go to great lengths to frustrate services that hinder botnets created with the ZeuS and… https://www.virusbulletin.com/blog/2011/03/cybercriminals-frustrated-botnet-trackers/

ENISA calls for revised botnet measurements

EU agency says current measures of botnet threat are misleading.
EU agency says current measures of botnet threat are misleading. European cyber security agency, ENISA (the European Network and Information Security Agency) has called for a… https://www.virusbulletin.com/blog/2011/03/enisa-calls-revised-botnet-measurements/

New peer-to-peer botnet discovered

New botnet shares fast flux DNS and other similarities with Storm and Waledac.
New botnet shares fast flux DNS and other similarities with Storm and Waledac. In the last few days of 2010, security researchers discovered a new botnet that shares many… https://www.virusbulletin.com/blog/2011/01/new-peer-peer-botnet-discovered/

41% of spam sent via Rustock botnet

Botnet spam back after short summer break.
Botnet spam back after short summer break. In its latest intelligence report, security firm MessageLabs reports that 41% of all spam is being sent through the Rustock botnet, an… https://www.virusbulletin.com/blog/2010/08/41-spam-sent-rustock-botnet/

Mariposa bot herders apply for job with security firm

Applicants weren't successful, but may not see prison either.
Applicants weren't successful, but may not see prison either.Panda Labs' Luis Corrons believed he was the victim if a practical joke when two people who had been involved in the… https://www.virusbulletin.com/blog/2010/05/mariposa-bot-herders-apply-job-security-firm/

Botnet taken down as ringleaders are arrested

'Mariposa' included almost 13 million zombies.
'Mariposa' included almost 13 million zombies. Spanish authorities have managed to take down the Mariposa botnet - one of the largest of its kind which is believed to have infected… https://www.virusbulletin.com/blog/2010/03/botnet-taken-down-ringleaders-are-arrested/

Botnets becoming more robust

Zeus botnet used Amazon's in-the-cloud service to control bots.
Zeus botnet used Amazon's in-the-cloud service to control bots. New reports by MessageLabs and McAfee show that botherders have learned a lesson following the take-down of McColo… https://www.virusbulletin.com/blog/2009/12/botnets-becoming-more-robust/

Take-down of rogue ISP sees temporary drop in spam levels

Spam levels back to normal within a few days.
Spam levels back to normal within a few days. The take-down of the rogue ISP Real Host on 1 August saw spam levels temporarily drop by more than a third, Messagelabs claims in its… https://www.virusbulletin.com/blog/2009/08/take-down-rogue-isp-sees-temporary-drop-spam-levels/

Yxe trojan infecting mobile phones

Symbian software-signing slipup certifies SMS spambot.
Symbian software-signing slipup certifies SMS spambot. A new trojan, the first of its kind, is affecting users of the Symbian mobile operating system by spreading itself via text… https://www.virusbulletin.com/blog/2009/07/yxe-trojan-infecting-mobile-phones/

McColo shutdown not felt the same by all recipients

Mailbox-level reduction may depend on spam detection methods.
Mailbox-level reduction may depend on spam detection methods. When the rogue provider McColo was taken offline in November 2008, depriving many botnets of their command and control… https://www.virusbulletin.com/blog/2009/07/mccolo-shutdown-not-felt-same-all-recipients/

Five botnets responsible for 75% of spam sent

Each infected machine sends spam at rate of almost two messages per second.
Each infected machine sends spam at rate of almost two messages per second.Spam levels have increased 60% since the beginning of this year, according to security company Marshal8e6… https://www.virusbulletin.com/blog/2009/07/five-botnets-responsible-75-spam-sent/

Korea DDoS surge mired in hype and confusion

Rows rumble on over sources and targets of botnet attacks.
Rows rumble on over sources and targets of botnet attacks. Last week's gush of denial-of-service attacks has sparked considerable excitement and argument, with rumours of possible… https://www.virusbulletin.com/blog/2009/07/korea-ddos-surge-mired-hype-and-confusion/

BBC botnet hijack proves controversial

Legal issues raised by broadcaster's demo of spamming, DDoS, cleanup attempt.
Legal issues raised by broadcaster's demo of spamming, DDoS, cleanup attempt. A BBC report into the dangers of botnets has got the corporation into hot water, after reporters took… https://www.virusbulletin.com/blog/2009/03/bbc-botnet-hijack-proves-controversial/

MS forms anti-Conficker alliance

Industry group to combine efforts, reward offered.
Industry group to combine efforts, reward offered.Microsoft has announced a collaborative effort to combat the Conficker (aka Downadup) botnet, the widespread infection making… https://www.virusbulletin.com/blog/2009/02/ms-forms-anti-conficker-alliance/

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.