Incidents

Social engineering: the latest chapter

A user notified us about a suspicious link being spread via MSN. Normally we would assume that there’s a new IM-Worm out there, since we’ve had quite a few of them this year.

However, the link itself attracted our attention:

http://www.vbulettin.com/[removed]

Naturally, anyone who follows information security knows Virus Bulletin: one of the oldest and most respected publications in the AV industry. Getting a VB award is a must for any reputable antivirus.

No, their site has not been hacked. If you read the URL carefully, you’ll notice that the word bulletin is misspelled – bulettin. Moreover, Virus Bulletin can be found on-line at a slightly different URL: www.virusbtn.com.

Most of us only scan URLs at best, and the malicious version is certainly close enough to the real thing to fool people. Virus writers are at it again: masquerading as a respected AV publication is a good way to get people to trust you.

Oh, before I forget… a new version of Backdoor.Win32.Landis is lurking at this link. If you receive this link, don’t click on it. There’s no IM-Worm involved, by the way – Landis sends the link out on command from its owner.

We’ve added detection for this new Trojan to our databases, so update just in case.

Social engineering: the latest chapter

Your email address will not be published.

 

Reports

Kimsuky’s GoldDragon cluster and its C2 operations

Kimsuky (also known as Thallium, Black Banshee and Velvet Chollima) is a prolific and active threat actor primarily targeting Korea-related entities. In early 2022, we observed this group was attacking the media and a think-tank in South Korea.

Andariel deploys DTrack and Maui ransomware

Earlier, the CISA published an alert related to a Stairwell report, “Maui Ransomware.” Our data should openly help solidify the attribution of the Maui ransomware incident to the Korean-speaking APT Andariel, also known as Silent Chollima and Stonefly.

Subscribe to our weekly e-mails

The hottest research right in your inbox