Martijn Lammerts
My own digital place with a little of everything

Large-Scale Ransomware Attack In Progress, Hits Europe Hard

27 June 2017

A large-scale ransomware attack is currently hitting various users. This is a new variant of the Petya ransomware family, which was first spotted last year. Trend Micro already protects its users from this attack, which we detect as Ransom_PETYA.SMA.

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

Large-Scale Ransomware Attack In Progress, Hits Europe Hard

Continue reading...

Following the Trail of BlackTech’s Cyber Espionage Campaigns

22 June 2017

BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology.

Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.

Over the course of their campaigns, we analyzed their modus operandi and dissected their tools of the trade—and uncovered common denominators indicating that PLEAD, Shrouded Crossbow, and Waterbear may actually be operated by the same group.

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

Following the Trail of BlackTech’s Cyber Espionage Campaigns

Continue reading...

AdGholas Malvertising Campaign Employs Astrum Exploit Kit

20 June 2017

At the end of April this year, we found Astrum exploit kit employing Diffie-Hellman key exchange to prevent monitoring tools and researchers from replaying their traffic. As AdGholas started to push the exploit, we saw another evolution: Astrum using HTTPS to further obscure their malicious traffic. We spotted a new AdGholas malvertising campaign using the...

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

AdGholas Malvertising Campaign Employs Astrum Exploit Kit

Continue reading...

Erebus Resurfaces as Linux Ransomware

19 June 2017

On June 10, South Korean web hosting company NAYANA was hit by Erebus ransomware (detected by Trend Micro as RANSOM_ELFEREBUS.A), infecting 153 Linux servers and over 3,400 business websites the company hosts.

In a notice posted on NAYANA’s website last June 12, the company shared that the attackers demanded an unprecedented ransom of 550 Bitcoins (BTC), or US$1.62 million, in order to decrypt the affected files from all its servers.

Erebus was first seen on September 2016 via malvertisements and reemerged on February 2017 and used a method that bypasses Windows’ User Account Control. Here are some of the notable technical details we’ve uncovered so far about Erebus’ Linux version.

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

Erebus Resurfaces as Linux Ransomware

Continue reading...

Analyzing the Fileless, Code-injecting SOREBRECT Ransomware

15 June 2017

by Buddy Tancio (Threats Analyst) Fileless threats and ransomware aren’t new, but a malware that incorporates a combination of their characteristics can be dangerous. Take for instance the fileless, code-injecting ransomware we’ve uncovered—SOREBRECT, which Trend Micro detects as RANSOM_SOREBRECT.A and RANSOM_SOREBRECT.B. We first encountered SOREBRECT during our monitoring in the beginning of second quarter this...

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

Analyzing the Fileless, Code-injecting SOREBRECT Ransomware

Continue reading...

Exploring the Online Economy that Fuels Fake News

13 June 2017

“Fake news” was relatively unheard of last year—until the U.S. election campaign period started, during which an explosion of misinformation campaigns trended. But despite its seemingly rampant spread, fake news is just one facet of public opinion manipulation and cyber propaganda that we see today. Whether it’s a company trying to promote a brand or a political party pushing an ideal, today’s information wars are often for control of the public’s worldview.

Our latest research paper, “The Fake News Machine: How Propagandists Abuse the Internet and Manipulate the Public”, delves into this phenomenon. It also tackles how a group with means and motivations, use of social media, and online promotion tools and services can effectively spread these campaigns. These are the components of what we call the “Fake News Triangle”, which we’ve found to be the pillars of success for any fake news and public opinion manipulation campaign.

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

Exploring the Online Economy that Fuels Fake News

Continue reading...

Analyzing Xavier: An Information-Stealing Ad Library on Android

13 June 2017

We have recently discovered a Trojan Android ad library called Xavier that steals and leaks a user’s information silently. Xavier’s impact has been widespread, with more than 800 applications embedding the ad library’s SDK having been downloaded millions of times from Google Play.

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

Analyzing Xavier: An Information-Stealing Ad Library on Android

Continue reading...