All publications

It’s the end of 2011 as we know it, and Microsoft feels fine finishing out the year with a handful of out-of-band holiday patches. This round is important not because the vulnerabilities directly impact massive numbers of customers and their online behavior on Windows laptops, tablets, and workstations, but because ASP.NET maintains vulnerable code allowing for easy DoS of hosting websites, authentication bypass techniques, and stealth redirections to other websites (most dangerously those sites host phish and hosting client side exploits). All of this could curdle your eggnog in the coldest of weather.

Loading...

Authors Categories Tags

Reports

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware “PowerPepper”.

Archive

ASP.NET Holiday Patches

Android malware: new traps for users

The Mystery of Duqu: Part Seven (Back to Stuxnet)

Stuxnet/Duqu: The Evolution of Drivers

“Profile me” bot on Twitter

Lab Matters – Brazil Banks in the Malware Glare

Cybercriminals celebrate Christmas with festive fraud

Spam report: November 2011

Thousands of European cards blocked following payment processor breach

Patch Tuesday December 2011

New Exploit Targeting Java Vulnerability Found in BlackHole Arsenal

Monthly Malware Statistics: November 2011

Lab Matters – Java exploits percolate

Online shopping made safe and convenient

What to Do About Carrier IQ

Congratulations, you’ve won! The reality behind online lotteries

Keyloggers: How they work and how to detect them (Part 1)

Scammers’ delivery service: exclusively dangerous

Reports

Sunburst backdoor – code overlaps with Kazuar

Lazarus covets COVID-19-related intelligence

Sunburst: connecting the dots in the DNS requests

What did DeathStalker hide between two ferns?

Subscribe to our weekly e-mails