VB Blog

VB2021 localhost call for papers: a great opportunity

Posted by   Virus Bulletin on   Mar 17, 2021

VB2021 localhost presents an exciting opportunity to share your research with an even wider cross section of the IT security community around the world than usual, without having to take time out of your work schedule (or budget) to travel.

Read more  

New article: Excel Formula/Macro in .xlsb?

Posted by   Virus Bulletin on   Mar 2, 2021

In a follow-up to an article published last week, Kurt Natvig takes us through the analysis of a new malicious sample using the .xlsb file format.

Read more  

New article: Decompiling Excel Formula (XF) 4.0 malware

Posted by   Virus Bulletin on   Feb 23, 2021

In a new article, researcher Kurt Natvig takes a close look at XF 4.0 malware.

Read more  

The Bagsu banker case - presentation

Posted by   Virus Bulletin on   Jan 29, 2021

At VB2019, CSIS researcher Benoît Ancel spoke about a quiet banking trojan actor that has been targeting German users since at least 2014.

Read more  

VB2021 call for papers - now open, to all!

Posted by   Virus Bulletin on   Jan 19, 2021

The call for papers for VB2021 is now open and we want to hear from you - we're planning for flexible presentation formats, so everyone is encouraged to submit, regardless of whether or not you know at this stage whether you'll be able to travel to Prague!

Read more  

In memoriam: Yonathan Klijnsma

Posted by   Virus Bulletin on   Jan 11, 2021

We were very sorry to learn of the passing of researcher Yonathan Klijnsma last week. Here, former VB Editor Martijn Grooten shares his memories of a talented researcher and a very kind person: this month, infosec lost a really good one.

Read more  

VB2020 localhost videos available on YouTube

Posted by   Virus Bulletin on   Jan 8, 2021

VB has made all VB2020 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

Read more  

VB2020 presentation & paper: 2030: backcasting the potential rise and fall of cyber threat intelligence

Posted by   Virus Bulletin on   Dec 8, 2020

At VB2020 localhost, threat intelligence consultant Jamie Collier used the analytical technique of backcasting to look at the rise and fall of the cyber threat intelligence industry.

Read more  

VB2020 presentation: Behind the Black Mirror: simulating attacks with mock C2 servers

Posted by   Virus Bulletin on   Dec 4, 2020

At VB2020 localhost, Carbon Black's Scott Knight presented an approach he and his colleagues have taken to more realistically simulate malware attacks.

Read more  

VB2020 presentation & paper: Advanced Pasta Threat: mapping threat actor usage of open-source offensive security tools

Posted by   Virus Bulletin on   Dec 2, 2020

At VB2020, researcher Paul Litvak revealed how he put together a comprehensive map of threat actor use of open-source offensive security tools.

Read more  

Search blog

Researchers crack into Storm botnet

Comms channels decrypted, automated removal possible.
Comms channels decrypted, automated removal possible. A group of German academics claim to have deciphered communications protocols used by the infamous 'Storm' botnet, allowing… https://www.virusbulletin.com/blog/2009/01/researchers-crack-storm-botnet/

Disconnection of dubious provider sees spam levels plummet

Web-hosting firm believed to be responsible for 75% of spam.
Web-hosting firm believed to be responsible for 75% of spam. Anti-spam researchers across the world reported a significant drop in the volume of spam seen after web-hosting firm… https://www.virusbulletin.com/blog/2008/11/disconnection-dubious-provider-sees-spam-levels-plummet/

Riders on a Storm

Researchers hijack botnet - and find spam success rates lower than previously believed.
Researchers hijack botnet - and find spam success rates lower than previously believed. Less than 1 in 12 million spam emails sent through the infamous Storm botnet led to a… https://www.virusbulletin.com/blog/2008/11/riders-storm/

Storm mails bring spoof World War 3 news

US-Iran war story used as hook for malware barrage.
US-Iran war story used as hook for malware barrage. The Storm botnet has been spamming in force again in the past week, with its expected run targeting 4th of July celebrations in… https://www.virusbulletin.com/blog/2008/07/storm-mails-bring-spoof-world-war-3-news/

MAAWG unveils spam and botnet battling policies

Working group of ISPs and net operators issue traffic calming guidelines.
Working group of ISPs and net operators issue traffic calming guidelines. Global collaboration body the Messaging Anti-Abuse Working Group (MAAWG) has ratified a set of guidelines… https://www.virusbulletin.com/blog/2008/06/maawg-unveils-spam-and-botnet-battling-policies/

41 months plus hefty fine for botherder

Cross-border operation brings adware crook to book.
Cross-border operation brings adware crook to book. A Florida man has been sentenced to 41 months in prison and fined $65,000 (approx. £32,000) after implanting bot software on… https://www.virusbulletin.com/blog/2008/06/41-months-plus-hefty-fine-botherder/

'Kraken' monster botnet causing controversy

As latest botnet scare debated, Storm keeps on blowing.
As latest botnet scare debated, Storm keeps on blowing. Recent reports of a massive botnet, apparently sneaking its trojans past security software and far outnumbering better-known… https://www.virusbulletin.com/blog/2008/04/kraken-monster-botnet-causing-controversy/

HP ships infected USB keys

Autorun worms found on batch of server setup devices.
Autorun worms found on batch of server setup devices. A batch of USB thumb drives containing software intended to assist in the setup of servers have been found to contain some… https://www.virusbulletin.com/blog/2008/04/hp-ships-infected-usb-keys/

Cybercriminals charged in New Zealand, Korea

Law closes in on alleged botnet master and rogue anti-spyware maker.
Law closes in on alleged botnet master and rogue anti-spyware maker. Police in New Zealand have charged an 18-year-old in connection with a botnet he is suspected of building and… https://www.virusbulletin.com/blog/2008/03/cybercriminals-charged-new-zealand-korea/

Botnet-herding team arrested in Quebec

Gang held for managing million-machine zombie net.
Gang held for managing million-machine zombie net. Canadian police have announced the arrests of up to 17 people in Quebec, in connection with a major botnet operation thought to… https://www.virusbulletin.com/blog/2008/02/botnet-herding-team-arrested-quebec/

Storm Valentines run under way

Seasonal spam and malware barrage gets going.
Seasonal spam and malware barrage gets going. The expected run of 'Storm' spams, pushing links to their latest line of malware disguised as Valentine's messages, has begun, with… https://www.virusbulletin.com/blog/2008/02/storm-valentines-run-under-way/

Stormy love letters

Storm botnet celebrates birthday with new wave of spam.
Storm botnet celebrates birthday with new wave of spam. Earlier this week malware experts warned of likely increased activity of the Storm botnet around Valentine's Day next month.… https://www.virusbulletin.com/blog/2008/01/stormy-love-letters/

Phishing danger increases as Storm botnet is hired out

Smart new trojan and Storm diversification add to online banking risk.
Smart new trojan and Storm diversification add to online banking risk. The dangers of banking online grew significantly in past weeks, as portions of the ever-expanding Storm… https://www.virusbulletin.com/blog/2008/01/phishing-danger-increases-storm-botnet-hired-out/

Botnet roasting on an open fire

FBI reports successes of operation Bot Roast; McAfee predicts cyber espionage for 2008.
FBI reports successes of operation Bot Roast; McAfee predicts cyber espionage for 2008. The FBI has revealed that eight individuals have been indicted, pled guilty or been… https://www.virusbulletin.com/blog/2007/12/botnet-roasting-open-fire/

Teenage botherder arrested in New Zealand

International cooperation also leads to eight arrests in the US.
International cooperation also leads to eight arrests in the US. Police in New Zealand have arrested an 18-year-old youth believed to be the herder of a botnet of 1.3 million… https://www.virusbulletin.com/blog/2007/11/teenage-botherder-arrested-new-zealand/

US botnet master confesses to crimes

Security consultant to plead guilty, could face heavy sentence.
Security consultant to plead guilty, could face heavy sentence. A Los Angeles man has agreed to plead guilty to several counts of fraud and unauthorised interfering with computer… https://www.virusbulletin.com/blog/2007/11/us-botnet-master-confesses-crimes/

Storm botnet evolution hints at spam and DDoS renting

Latest change in tactics could mean zombie clusters for hire.
Latest change in tactics could mean zombie clusters for hire. The latest twist in the long-running 'Storm' saga, the use of encryption in communications between infected hosts and… https://www.virusbulletin.com/blog/2007/10/storm-botnet-evolution-hints-spam-and-ddos-renting/

Storm DDoS hits anti-scam sites

419 fighters attacked - NFL and TOR latest spam hooks.
419 fighters attacked - NFL and TOR latest spam hooks. The massive botnet amassed by the 'Storm' (Zhelatin/Nuwar/Dorf/etc.) attack continues to target new victims, with the TOR… https://www.virusbulletin.com/blog/2007/09/storm-ddos-hits-anti-scam-sites/

House of Lords warns of e-crime fears

Report recommends harder, smarter fight against online dangers.
Report recommends harder, smarter fight against online dangers. A major report by the Science and Technology Committee of the UK's House of Lords has found the internet to be rife… https://www.virusbulletin.com/blog/2007/08/house-lords-warns-e-crime-fears/

Worries of Storm forming massive botnet

DDoS danger looms as infection levels boom.
DDoS danger looms as infection levels boom. Repeated waves of the 'Storm' trojan attacks continue to be spammed out, with the latest using more eCards to hook in still more… https://www.virusbulletin.com/blog/2007/08/worries-storm-forming-massive-botnet/

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.