Internet threat news

The last several months have been plagued by countless reports of hardware routers being exploited by hackers for various reasons. Popular router brands including Belkin, Net Gear, and Linksys have all been targeted by cybercriminals and used as botnets to launch DDoS attacks. In fact, the PlayStation and Xbox Live networks were both taken offline by hackers using exploited routers as the basis for the attack. Mandiant, a sister company of Swedish security firm FireEye, recently uncovered a new router vulnerability that could mean big trouble for businesses around the world relying on Cisco routers. The backdoor malware, which has been named SYNful Knock by security researchers, is designed to compromise popular business-class Cisco routers and provides the hackers with escalated backdoor privileges to the entire network by modifying the router’s firmware image. This new malware variant is different than previous versions of malware designed to compromise consumer routers because the malware persists even after the router has been rebooted.

A new malvertising campaign was recently discovered that has been running for at least three weeks without being detected although security experts concede that the threat could have been operating undetected for much longer than that. Considering the large number of malvertising schemes that have been highlighted on this blog in recent months, it is becoming increasingly clear that businesses need to be more vigilant than ever before when it comes to selecting the companies they use to serve online advertisements to visitors. Several well-known online presences, including the Drudge Report, Answers.com, and eBay’s UK branch, were all recently affected by tainted online ad networks that have been serving ads infected with the Angler exploit kit. The Angler exploit kit is currently one of the most elusive and dangerous online exploit kits in the wild and is capable of finding known vulnerabilities in common Web browser plugins in an attempt to infect PCs with an assortment of malicious programs depending on the needs of the cybercriminals behind the campaign.

A new version of the persistent and powerful adware program known as Shopperz has been spotted in the wild and this new version has security researchers wondering what other tricks may be in store for PC users in the future due to the sophistication of this new adware variant. Sometimes also referred to as Groover, Shopperz works by injecting ads into a PC users’ Web traffic using methods that are considered by security researchers to be both malicious and deceptive. Some of the techniques used by Shopperz to take over an infected PC include installing an extension in both Firefox and Internet Explorer and the creation of a Windows service that makes it extremely difficult for victims to remove the add-ons from both popular Web browsers. One such service is even designed to operate in Safe Mode - a Windows boot option that is often used to clean a PC of malware. Shopperz is also capable of creating a rogue Layered Service Provider (LSP) within the Window’s network stack.

An extremely dangerous and highly sophisticated new banking Trojan was recently spotted in the wild by researchers from IBM’s Security X-Force. Named Shifu, which means thief in Japanese, this banking Trojan appears to have been active since April of this year despite only being discovered in recent weeks by IBM staff members leveraging antifraud platforms that continuously monitor customer endpoints around the world. Shifu is currently targeting 14 Japanese banks as well as electronic banking platforms throughout Europe although at this time only Japan is experiencing active attacks from this Trojan. Shifu contains a variety of advanced features, many of which appear to be borrowed from the leaked source code of other notorious banking Trojans including Zeus, Dridex, Shiz, and Gozi.

JavaScript is still heavily used as a scripting language for interactive website effects. In fact, JavaScript is still number 8 on the Top 10 coding languages this year despite the fact that both JavaScript and Java, its proverbial big brother, are heavily leveraged by hackers to distribute malicious software and as Trojan attack vectors. It’s no secret that any active content solution can leave your PC vulnerable to attack and the two JavaScript-based exploits described below are no exception. Despite the potentially tragic consequences of infection by either of these malware campaigns, it’s worth pointing out that both are easily blocked with basic PC maintenance such as automatic updates and a current antivirus software solution. Recently, Threatpost reported that a flood of spam emails have been detected that contain a .JS attachment filled with obfuscated JavaScript code.

As summer slowly comes to a close, retailers are already ramping up for their most profitable quarter of the year…the holiday shopping season. This is a notoriously busy time for cybercriminals looking to cash in on the large amounts of payment data sent across the Internet during this time of year but hackers aren’t waiting until the holidays to begin install POS malware in as many retail locations as possible; months before the shopping frenzy even begins. The notorious Andromeda botnet has been used for years to deliver malicious payloads across multiple industries and platforms. GamaPOS is one of the newest and most dangerous POS scraping malware variants in the wild. The problem with GamaPOS is that is has a low success rate when attempting to infect new systems because there are very few POS backdoors (not to mention that media coverage of major retail breaches over the last several months have put everyone on high alert).

There have been an increasing number of advanced persistent threats (APTs) discovered in recent months. These attacks threaten PC security on a global scale and the people behind these attacks are no slouches either. To create an effective APT campaign, many resources are required that go well beyond the scope of the everyday cybercriminal out looking to make a few fraudulent dollars at the expense of others. In general, a large amount of time, money, and knowledge is required to create the custom malicious programs that are at the heart of any APT campaign. These campaigns are specifically created to carry out specific, targeted attacks against powerful targets – usually government and state-sponsored entities. Recently, a new APT campaign was discovered by security researchers from AlienVault Labs that has been dubbed Operation Lotus Blossom.

One of the most common ways that modern antivirus software uses to detect malicious software is the way in which that malware behaves on the PC. In other words, the way malware acts once installed is usually a sure sign that a malware infection has occurred.  Until now… A new type of malware was recently discovered by IT security firm FireEye that actually mimics the behavior of a normal computer user while it’s compromising files on the infected PC. This new malware variant, known as Hammertoss, is so advanced that it can even time itself to work within the victim’s work schedule - making it nearly impossible to detect using the standard detection algorithms that antivirus software has relied on for years to detect malicious activity.

Just one week before Microsoft’s newest operating system is released, a security flaw has already been discovered that affects all current versions of the Windows OS including the company’s latest addition, Windows 10. Microsoft issued an emergency security fix on Monday that has been classified as “critical” due to the severity of the vulnerability. An exploit has been discovered that essentially affords hackers complete access to a victim’s computer. According to an online security bulletin posted by Microsoft on Monday, this vulnerability allows hackers to take “complete control of the affected system.” This particular vulnerability allows hackers to install, view, change, and delete data or create new accounts with full administrative privileges.

Kovter is a Trojan specifically designed to exploit advertising campaigns. Often referred to as click or advertising fraud, the Trojan is used to hijack Web browser sessions in order to simulate a victim’s machine clicking on advertisements to generate advertising revenue for the hackers behind the malware campaign. A well-known malware security researcher who calls himself Kafeine first discovered the latest version of this threat. Kafeine specializes in tracking and studying drive-by download attacks that rely on exploit kits to find vulnerabilities in popular Web browser plug-ins including Adobe Flash Player, Adobe Reader, Microsoft Silverlight, and Java. According to Kafeine, the latest version of Kovter is being distributed using multiple exploit kits that are designed to capitalize on zero day vulnerabilities found within the browser plug-ins mentioned above.

Back in June, security researchers discovered that the source code for both the building tool and control panel of ZeusVM had been leaked to the public. This leak means that anyone can build a Zeus-powered botnet without any programming knowledge. Initially, the leak was kept secret as security researchers from Malware Must Die (MMD) worked to keep these files from becoming widely available. Unfortunately, the leaked source code spread faster than the researchers could have imagined and as a result, MMD made information about the leak publicly available in an effort to alert security professionals around the world about this concerning threat. ZeusVM, sometimes also known as KINS, is a banking Trojan that works by hijacking the Web browser process. Once this process has been hijacked, the Trojan can modify and/or steal information being exchanged between the infected client machine and the server hosting the secure session.

Hackers often rely on compromised websites as a way to host and distribute malicious software via drive-by download attacks. A drive-by download uses an exploit kit to exploit known vulnerabilities in popular Web browser plugins including Java, Silverlight, and Adobe Flash. Recently, security researchers discovered a group of cybercriminals that have chosen to take a different path. By exploiting vulnerable wireless routers, these criminals have found a way to distribute the notorious Dyre malware strain without the need for compromised websites to deliver the payload. Dyre, which is also known as Dyreza and Battdil, is typically installed by a payload-carrying Trojan that modern antivirus software detects as “Upatre.”

As PC users become increasingly vigilant when it comes to protecting themselves from a constant onslaught of malware threats, hackers keep coming up with clever new ways to sneak past antivirus solutions and install malware on PCs around the world. In addition to creating new ways of distributing malware, hackers have also become increasingly adept at preventing security researchers from reverse engineering many new strains of malware by using a series of basic checks on an infected system to ensure it isn’t a sandbox analysis environment. A new form of malware, known as Stegoloader, combines a new way to deliver its malicious payload with anti-detection tools that have made it difficult for security researchers to figure out exactly how it works.

A powerful computer worm known as Duqu 2.0 has been recently discovered in the networks of three hotels used to host the P5+1 negotiations. These negotiations included representatives from the US, UK, France, Germany, China, and Russia and were created to discuss Iranian nuclear capabilities over the last year and a half. Although the official Kaspersky report does not name the hotels in question, it is believed that this worm was deployed by a state-sponsored Israeli campaign in an attempt to gather sensitive intelligence as it relates to the nuclear talks and anything else of relevance that the worm was able to gather in the process. Although a direct link to an Israeli sponsored campaign cannot be proven at the time of this writing, it’s worth pointing out that just this past March, the US Government accused Israel of spying on the negotiations and using the intelligence gathered to persuade Congress to undermine the talks.