TechWorld

Recent attacks associated with the TrickBot banking Trojan have been targeting private banks, and the threat is also sharpening its focus on business banking, IBM’s X-Force security team warns. Campaigns observed in the UK, Australia, and Germany were showing new redirection attacks focused on new brands, including private banks, private wealth management firms, investment banking, and a retirement insurance and annuity company. The Trojan also added some new brands to its list of targeted business banks, the security researchers say. TrickBot was initially observed in October last year, when Fidelis Cybersecurity researchers determined that the threat had a strong connection to the Dyre gang . Before the end of 2016, the new Trojan was observed in a series of attacks targeting banks in the UK and Australia , as well as in campaigns aimed at financial institutions in Asia . IBM has since  discovered that the malware is targeting 20 new private banking brands and eight building societi...

  In an operation targeting cybercrime across Asean, the Interpol says it has identified thousands of compromised systems that included command-and-control (C2) servers infected with malware and websites run by governments. Some 8,800 of the servers across eight countries were found to be infected with various malware codes including those targeting financial institutions and used to launch DDoS (distributed denial-of-service) attacks. Investigations involving these systems were still ongoing, according to a statement released by Interpol, which ran the Asean operation out of its Global Complex for Innovation in Singapore. It added that some 270 websites were found to have been infected with a malware code that exploited a vulnerability in the website design software. These compromised sites included those run by governments, which might contain personal data of their citizens, it said. “A number of phishing website operators were also identified, including one with links to Nigeri...

A new kind of attack is targeting unsecured Internet of Things devices by scrambling their code and rendering them useless. Security firm Radware first spotted the newly found “BrickerBot” malware last month after it started hitting its own honeypots, logging hundreds of infection attempts over a few days. When the malware connects to a device with their default usernames and passwords — often easily found on the internet — the malware corrupts the device’s storage, leading to a state of permanent denial-of-service (PDoS) attack, also known as “bricking.” In other words, this attack “damages a system so badly that it requires replacement or reinstallation of hardware,” said Radware. It’s a novel take on an ongoing security problem with Internet of Things devices: Botnets controlled by hackers, like the Mirai malware, typically infect unsecured devices that are enlisted as part of wider bandwidth-stealing attacks to bring down websites and services by overwhelming them with internet tra...

No More Ransom, so is the Ransomware Threat. Launched less than a year ago, the No More Ransom (NMR) project has increased its capacity with new partners and new decryption tools added to its now global campaign to combat Ransomware. Started as a joint initiative by Europol, the Dutch National Police, Intel Security and Kaspersky Lab, No More Ransom is an anti-ransomware cross-industry initiative to help ransomware victims recover their data without having to pay ransom to cyber criminals. The online website not just educates computer users to protect themselves from ransomware, but also provides a collection of free decryption tools. Since December, more than 10,000 victims from all over the world have been able to decrypt their locked up devices without spending a penny, using ransomware decryption tools available free of charge on this platform. Statistics show that most of the website visitors were from Russia, the Netherlands, the U.S., Italy, and Germany. The platform is now ava...

Law enforcement authorities from Europe and Russia have arrested five members of an international cyber criminal gang for stealing $3.2 million cash from ATMs using malware. Three of the suspects, Andrejs Peregudovs (41), of Latvia, Niklae Penkov (34) of Moldova, and Mihail Colibaba (30) of Romania, were arrested in Taiwan by the Taiwanese Criminal Investigation Bureau last summer, have already been sentenced to 5 years in prison for their role in a massive ATM heist operation, involving 22 individuals from 6 countries. The European-based cyber criminal gang used a variety of different hacking techniques to infect ATMs with malware and force them to dispense cash. According to Europol that began its investigation in early 2016, the gang used spear-phishing emails containing malicious attachments to target bank employees and penetrate the bank's internal networks. From there, the cyber crooks then located and hacked into the network of ATMs from the inside, and used a malicious so...

Security researchers have discovered a new variant of the HummingBad malware hiding in more than 20 Android apps on Google Play Store. The infected apps were already downloaded by over 12 Million unsuspecting users before the Google Security team removed them from the Play Store. Dubbed HummingWhale by researchers at security firm Check Point, the new malware utilizes new, cutting-edge techniques that allow the nasty software to conduct Ad fraud better than ever before and generate revenue for its developers. The Check Point researchers said the HummingWhale-infected apps had been published under the name of fake Chinese developers on the Play Store with common name structure, com.[name].camera, but with suspicious startup behaviors. "It registered several events on boot, such as TIME_TICK, SCREEN_OFF and INSTALL_REFERRER which [were] dubious in that context," Check Point researchers said in a blog post published Monday.   The HummingWhale malware is tricky than HummingBad,...

A 21-year-old former Langley High School student, who won a Programmer of the Year Award in high school, pleaded guilty on Friday to charges of developing and selling Limitless Keylogger  malware that infected thousands of victims. Zachary Shames from Virginia pleaded guilty in a federal district court and now faces a maximum penalty of up to 10 years in prison for his past deeds. Shames was arrested this summer while he was working as a technical intern at Northrop Grumman, a security and defense government contractor, developing front-end site code and backend Java software and managing a MySQL database, according to what appears on his Linkedin page. According to a press release from the U.S. Department of Justice, Shames developed a keylogger in 2013 that allowed users to steal sensitive information, including passwords and banking credentials, from a victim's computer, while he was still a high school student in 2013.   Keylogger is malicious software designed to record every...

Most people believe that end-to-end encryption is the ultimate way to protect your secret communication from snooping, and it does, but it can be intercepted if not implemented correctly. After introducing " end-to-end encryption by default " last year, WhatsApp has become the world's largest secure messaging platform with over a billion users worldwide. But if you think your conversations are completely secure in a way that no one, not even Facebook, the company that owned WhatsApp, can intercept your messages then you are highly mistaken, just like most of us and it's not a new concept. Here's the kick: End-to-end encrypted messaging service, such as WhatsApp and Telegram, contain a backdoor that can be used, if necessary, by the company and of course hackers, or the intelligence agencies to intercept and read your end-to-end encrypted messages, and that’s all without breaking the encryption. And that backdoor is — TRUST . No doubt most of the encrypted messagi...

If you own an Android smartphone, Beware! A new Android malware Gooligan that has already breached more than 1 Million Google accounts is infecting around 13,000 devices every day. Dubbed  Gooligan , the malware roots vulnerable Android devices to steal email addresses and authentication tokens stored on them. With this information in hands, the attackers are able to hijack your Google account and access your sensitive information from Google apps including Gmail, Google Photos, Google Docs, Google Play, Google Drive, and G Suite. Researchers found traces of Gooligan code in dozens of legitimate-looking Android apps on 3rd-party app stores, which if downloaded and installed by an Android user, malware starts sending your device’s information and stolen data to its Command and Control (C&C) server. "Gooligan then downloads a rootkit from the C&C server that takes advantage of multiple Android 4 and 5 exploits including the well-known VROOT (CVE-2013-6282) and Towelroot (CV...