Incidents

It’s the end of your computer system as you know it … NOT

We’ve just received a report of a destructive virus that will wipe all data from the hard disk. We’re not the least bit worried though. Why? Well, it’s just a hoax.

So what is a hoax? Typically, a hoax takes the form of an e-mail message that carries a warning about the ‘imminent danger’ posed by a non-existent threat. The aim is to scare users into sending the false warning to their contacts: friends, family, colleagues. Hoaxes cause no direct harm to data. However, a user’s well-meaning action in forwarding the message gives credence to the hoax, spreads the fear, doubt and uncertainty even further and clogs up networks with increasing amounts of ‘self-inflicted spam’.

Trying to stamp out a hoax can be as difficult as putting out a forest fire: ‘successful’ hoaxes often come back again and again, like recurrent bouts of malaria. To make matters worse, sometimes a real threat will model itself on the ‘look-and-feel’ of a previous hoax.

So how do you decide if something’s a hoax or not? Here are some general guidelines.

  • Don’t simply forward such an e-mail message without checking first to see if it’s a hoax.
  • If it didn’t come from a security vendor’s news or alert service, check out the hoax sections of specialist security web sites.
  • If in doubt, check with your anti-virus vendor, or send it to ‘newvirus@kaspersky.com’ for analysis.
  • Never click on attachments in e-mails that come from an unknown source.

It’s the end of your computer system as you know it … NOT

Your email address will not be published. Required fields are marked *

 

Reports

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

What did DeathStalker hide between two ferns?

While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware “PowerPepper”.

Subscribe to our weekly e-mails

The hottest research right in your inbox