malware
-
Blog
Latrodectus malware and how to defend against it with Wazuh
Latrodectus is a versatile malware family that employs advanced tactics to infiltrate systems, steal sensitive data, and evade detection. Named after the black widow spider genus “Latrodectus”, this malware behaves with similar stealth and aggression. It targets various systems, including corporate networks, financial institutions, and individual users. Its ability to morph and adapt is a concern for cybersecurity professionals worldwide.…
Read More » -
Blog
Crypto-stealing malware posing as a meeting app targets Web3 pros
Cybercriminals are targeting people working in Web3 with fake business meetings using a fraudulent video conferencing platform that infects Windows and Macs with crypto-stealing malware. The campaign is dubbed “Meeten” after the name commonly used by the meeting software and has been underway since September 2024. The malware, which has both a Windows and a macOS version, targets victims’ cryptocurrency assets,…
Read More » -
Blog
BootKitty UEFI malware exploits LogoFAIL to infect Linux systems
The recently uncovered ‘Bootkitty’ Linux UEFI bootkit exploits the LogoFAIL flaw, tracked as CVE-2023-40238, to target computers running on vulnerable firmware. This is confirmed by firmware security firm Binarly, which discovered LogoFAIL in November 2023 and warned about its potential to be used in actual attacks. Bootkitty and LogoFAIL connection Bootkitty was discovered by ESET, who published a report last…
Read More » -
Blog
SpyLoan Android malware on Google play installed 8 million times
A new set of 15 SpyLoan apps with over 8 million installs was discovered on Google Play, targeting primarily users from South America, Southeast Asia, and Africa. The apps were discovered by McAfee, a member of the ‘App Defense Alliance,’ and have now been removed from Android’s official app store. However, their presence on Google Play is indicative of the…
Read More » -
Blog
Researchers discover first UEFI bootkit malware for Linux
The first UEFI bootkit specifically targeting Linux systems has been discovered, marking a shift in stealthy and hard-to-remove bootkit threats that previously focused on Windows. Named ‘Bootkitty,’ the Linux malware is a proof-of-concept that works only on some Ubuntu versions and configurations rather than a fully fledged threat deployed in actual attacks. Bootkits are malware designed to infect a computer’s…
Read More » -
Blog
Salt Typhoon hackers backdoor telcos with new GhostSpider malware
The Chinese state-sponsored hacking group Salt Typhoon has been observed utilizing a new “GhostSpider” backdoor in attacks against telecommunication service providers. The backdoor was discovered by Trend Micro, which has been monitoring Salt Typhoon’s attacks against critical infrastructure and government organizations worldwide. Along with GhostSpider, Trend Micro discovered that the threat group also uses a previously documented Linux backdoor named…
Read More » -
Blog
Chinese hackers target Linux with new WolfsBane malware
A new Linux backdoor called ‘WolfsBane’ has been discovered, believed to be a port of Windows malware used by the Chinese ‘Gelsemium’ hacking group. ESET security researchers who analyzed WolfsBane report that WolfsBane is a complete malware tool featuring a dropper, launcher, and backdoor, while it also uses a modified open-source rootkit to evade detection. The researchers also discovered ‘FireWood,’ another…
Read More » -
Blog
5 Problems on Your Computer That Might be Caused by Malware
Malware is the scary boogeyman of computers, supposedly capable of destroying everything you know and love. But what does it actually look like? How can you tell when your computer is infected? If your computer has any of the following problems, that could be a dead giveaway. 1 Your Browser is Forcefully Redirected Without Warning Forceful redirects are a huge…
Read More » -
Blog
Botnet exploits GeoVision zero-day to install Mirai malware
A malware botnet is exploiting a zero-day vulnerability in end-of-life GeoVision devices to compromise and recruit them for likely DDoS or cryptomining attacks. The flaw is tracked as CVE-2024-11120 and was discovered by Piort Kijewski of The Shadowserver Foundation. It is a critical severity (CVSS v3.1 score: 9.8) OS command injection problem, allowing unauthenticated attackers to execute arbitrary system commands…
Read More » -
Blog
Unpatched Mazda Connect bugs let hackers install persistent malware
Attackers could exploit several vulnerabilities in the Mazda Connect infotainment unit, present in multiple car models including Mazda 3 (2014-2021), to execute arbitrary code with root permission. The security issues remain unpatched and some of them are command injection flaws that could be leveraged to obtain unrestricted access to vehicle networks, potentially impacting the car’s operation and safety. Vulnerability details…
Read More »