Cybercrime, TrickBot has been upgraded with the “masrv” module
Kryptos Logic cybersecurity experts: It’s a network scanner that incorporates the Masscan open-source tool in the malware.
Cybercrime, new courier-themed Dridex campaign
The xlsm attachment, distributed by the Cutwail botnet, contacts a random link from an internal list and downloads the malware.
Cybercrime, QuakBot exploits Kayak Republic af 2015 APS certificates
New signed campaign to trick victims’ antivirus, allowing them to download and install the malware via attachment.
Cybercrime, Emotet botnet disrupted in an international coordinated effort
Europol: The malware infrastructure has been hit from inside and infected machines have been redirected towards another one controlled by law enforcements.
Cybercrime, ABC BIOS d.o.o. certificates exploited by QuakBot
New signed campaign to allow victims to download and install the malware via attachment, tricking the antivirus.
Cybercrime, new Dridex campaign via couriers and Cutwail
Fake xlsm invoice, distributed by the botnet, contacts random links from an internal list and download the malware.
Cybercrime, Dridex global campaign via xlsm and Cutwail
False xlsm invoice, distributed by the botnet, contacts a random link from an internal list and download the dll with starts malware infection.
Cybercrime, new Dridex global campaign via Dropbox
The link in the email downloads an xls file. This downloads the dll, from an internal list of URLs, starting the malware infection.
Cybercrime, new Hancitor campaign via email attachment
The doc file starts malware infection thanks to the internal dll. The trojan is used as a downloader of other payloads such as Cobalt Strike and Ursnif / Gozi.
Cybercrime, Dridex is back with the invoice-themed campaign
Real company fake mail contains an xlsm file. This contacts a link from an internal list and downloads the dll, which starts the malware infection.