Operation "TooHash": how targeted attacks work
The experts of G DATA’s SecurityLabs discovered a cyber-espionage campaign that perfectly exemplifies the way how targeted attacks work. The purpose of this campaign was to steal valuable documents from the targeted entity. We entitle this operation “TooHash”.
COM Object hijacking: the discreet way of persistence
G DATA SecurityLabs experts discovered a new Remote Administration Tool, which we dubbed COMpfun. This RAT supports 32-bit and 64-bit Windows versions, up to the Windows 8 operating system. The features are rather common for today’s espionage tools: file management (download and upload), screenshot…
New FrameworkPOS variant exfiltrates data via DNS requests
Between April and September 2014, the American retailer Home Depot was targeted by criminals who aimed to steal credit card information. The malware used during these attacks targets Point of Sale systems. Home Depot said that the cyber criminals stole 56 million of debit and credit card numbers…
Cuckoo Sandbox Evasion PoC available
In the beginning of this week we discovered a security flaw in the famous malware analysis framework „Cuckoo Sandbox“. We disclosed this bug to the developers on the 7th of October 2014. Not even three hours later the patch was verified and the updates were supplied by the developers.
Poweliks: the persistent malware without a file
When security researchers talk about malware, they usually refer to files stored on a computer system, which intends to damage a device or steal sensitive data from it. Those files can be scanned by AV engines and can be handled in a classic way. The following analysis is an example of malware which…
G DATA Malware Report July - December 2013
G DATA’s Malware Report H2 2013 includes the most important statistics and information regarding new malware types, websites’ threat potential as well as botnet and banking Trojan activities. Check out the essential facts.
Android smartphone shipped with spyware
For the first time ever, the experts at the German security vendor have discovered a smartphone that comes with extensive spyware straight from the factory. The malware is disguised as the Google Play Store and is part of the pre-installed Android apps. The spyware runs in the background and cannot…
Analysis of Uroburos, using WinDbg
Uroburos was already described as a very sophisticated and highly complex malware in our G DATA Red Paper, where we had a look at the malware’s behavior. This malware belongs to a specific type called rootkit. The general purpose of a rootkit is to modify the behavior of the system and, especially,…
Spam campaign still spreading: banking Trojan Bebloh circulated as email attachment
Another banking Trojan is now being distributed as part of the currently observed spam campaign: Bebloh. This is known for being sent as an email attachment – precisely as it is in the latest instance. It is possible that copycats have jumped onto the first scam, as experts at G DATA SecurityLabs…
Massive spam campaign returns: Cridex successor Swatbanker is spread
The attackers are sending out highly professional looking emails in the name of several large telecommunications providers and German banks: the reputation of Deutsche Telekom and Vodafone as well as that of Volksbank/Fiducia and Sparkasse is currently being misused for these waves of spam. The…
Karsten Hahn
Principal Malware Researcher
Tim Berghoff
Security Evangelist
