Securelist

YARA webinar follow up

Apr 6, 2020, 7:00 am

If you read my previous blogpost, “Hunting APTs with YARA” then you probably know about the webinar we’ve done on March 31, 2020, After it we received a number of interesting questions and as I promised, I will try to answer them below. Read Full Article

APT reports

iOS exploit chain deploys LightSpy feature-rich malware

Mar 26, 2020, 5:32 pm

Alexey Firsh, Kurt Baumgartner, Brian Bartholomew

A watering hole was discovered on January 10, 2020 utilizing a full remote iOS exploit chain to deploy a feature-rich implant named LightSpy. The site appears to have been designed to target users in Hong Kong based on the content of the landing page. Read Full Article

APT reports

WildPressure targets industrial-related entities in the Middle East

Mar 24, 2020, 10:00 am

Denis Legezo

Kaspersky discovered a malicious campaign distributing a fully fledged C++ Trojan that we call Milum. All the victims we registered were organizations from the Middle East. At least some of them are related to industrial sector. Read Full Article

Events

Hunting APTs with YARA

Mar 18, 2020, 4:16 pm

Costin Raiu

If you have wondered how to leverage YARA better and how to achieve a new level of knowledge in APT detection, mitigation and response, we can help a bit with a preview of the secret ingredients. Read Full Article

Research

MonitorMinor: vicious stalkerware?

Mar 16, 2020, 10:00 am

Victor Chebyshev

The other day, our Android traps ensnared an interesting specimen of software that can be used for stalking. On closer inspection, we found that this app outstrips all existing software of its class in terms of functionality. Read Full Article

Malware descriptions

Cookiethief: a cookie-stealing Trojan for Android

Mar 12, 2020, 10:00 am

Anton Kivva, Igor Golovin

We recently discovered a new strain of Android malware. Trojan-Spy.AndroidOS.Cookiethief turned out to be quite simple. Its main task was to acquire root rights on the victim device, and transfer cookies used by the browser and Facebook app to the cybercriminals’ server. Read Full Article

Incidents

Mokes and Buerak distributed under the guise of security certificates

Mar 5, 2020, 10:00 am

AMR

We recently discovered a new approach to the well-known distributing malware technique: visitors to infected sites were informed that some kind of security certificate had expired. Read Full Article

Malware descriptions

Roaming Mantis, part V

Feb 27, 2020, 2:00 pm

Suguru Ishimaru

Kaspersky has continued to track the Roaming Mantis campaign. The group’s attack methods have improved and new targets continuously added in order to steal more funds. Read Full Article

Malware reports

Mobile malware evolution 2019

Feb 25, 2020, 10:00 am

Victor Chebyshev

In 2019, Kaspersky mobile products and technologies detected 3,503,952 malicious installation packages, 69,777 new mobile banking Trojans and 68,362 new mobile ransomware Trojans. Read Full Article