Alvaro is a ransomware-type program designed to encrypt files and demand ransoms for their decryption. After we launched a sample of Alvaro on our test system, it encrypted files and altered their filenames. Titles of the affected files were appended with the attackers' email, a unique ID assigne
Our inspection of the "Incoming Messages Were Not Delivered" email revealed that it is spam. This letter claims that several messages failed to reach the recipient's inbox. This mail targets email passwords, which are extracted through a phishing site disguised as an account sign-in page.
While inspecting suspicious websites, our research team discovered the mca-track[.]online and mcatrack[.]online rogue pages. They are designed to promote scams and browser notification spam. Additionally, such webpages can redirect visitors elsewhere (likely unreliable/malicious sites). Most users
While checking the TursiopsTruncatus browser extension, we found troubling activities like adding the "Managed by your organization" feature to Chrome settings and collecting data. Our encounter with TursiopsTruncatus occurred when we investigated a harmful installer downloaded from an unreliable
After examining the "Product Request" email, we determined that it is spam. This message claims to contain documentation regarding an urgent purchase. The attachment is a phishing file targeting email account log-in credentials. The email with the subject "Request for Quotes" (may vary) st
During our inspection of malware samples uploaded to VirusTotal, our team discovered a ransomware variant dubbed Grounding Conductor. The purpose of Grounding Conductor is to prevent victims from accessing their files by zipping and encrypting them. Additionally, this ransomware places a ransom no
Our researchers found the S4b ransomware-type program while investigating new malware submissions to the VirusTotal website. This program is part of the Phobos ransomware family. S4b is designed to encrypt data and demand payment for its decryption. On our test machine, this ransomware encrypted
While assessing the MyWallPaper, it became apparent that its primary goal is to operate as a browser hijacker, with the objective of endorsing mywallpaper.co, a fraudulent search engine. This extension modifies web browser settings to establish control over it. To avoid potential damage, users wit
During our assessment of the LavandulaAngustifolia browser extension, we identified concerning actions, such as enabling the "Managed by your organization" feature in Chrome browsers, controlling specific browser components, and gathering data. Our interaction with LavandulaAngustifolia took place
While reviewing malware samples on the VirusTotal platform, we encountered the Rzew ransomware, which belongs to the Djvu family. When this ransomware infects a computer, it encrypts files and adds the ".rzew" extension to their filenames. For example, "1.jpg" would be transformed into "1.jpg.rzew