Malware descriptions

LdPinch…again.

Over the last few days new variants of Trojan-PSW.Win32.LdPinch have been spreading actively on the Russian internet. This Trojan has been mass mailed, and also spreads via ICQ. Email and ICQ messages may be from unknown users (usually a woman), or from users on your contact list.

There’s nothing really new here. New variants are included in the antivirus database updates we release every hour. So why are we writing about it?

The answer’s simple: lots of users have been careless enough to launch the attachment which contains the Trojan, or to click on the link in the ICQ message which leads to the Trojan. And then, as its name indicates, LdPinch steals passwords from the victim machine.

If you’re one of these users, to prevent any further damage you should:

  • Update your antivirus databases
  • Perform a full scan of your computer in order to remove the malicious code
  • Change all passwords for your email, ICQ, and other network applications

LdPinch…again.

Your email address will not be published. Required fields are marked *

 

Reports

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Andariel evolves to target South Korea with ransomware

In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. After a deep analysis, we came to a conclusion: the Andariel group was behind these attacks.

Subscribe to our weekly e-mails

The hottest research right in your inbox