Historical OSINT - Summarizing 2 Years of Webroot's Threat Blog Posts Research

It's been several years since I last posted a quality update at the industry's leading threat-intelligence gathering Webroot's Threat Blog following a successful career as lead security blogger and threat-intelligence analyst throughout 2012-2014.

In this post I'll summarize two years worth of Webroot's Threat Blog research with the idea to provide readers with the necessary data information and knowledge to stay ahead of current and emerging threats.

01. January - 2012

• Cybercriminals generate malicious Java applets using DIY tools
• A peek inside the uBot malware bot
• Researchers intercept a client-side exploits serving malware campaign
• How phishers launch phishing attacks
• A peek inside the Umbra malware loader
• How malware authors evade antivirus detection
• Inside AnonJDB – a Java based malware distribution platforms for drive-by downloads
• Zappos.com hacked, 24 million users affected
• Inside a clickjacking/likejacking scam distribution platform for Facebook
• A peek inside the Cythosia v2 DDoS Bot
• A peek inside the PickPocket Botnet
• Mass SQL injection attack affects over 200,000 URLs
• Email hacking for hire going mainstream
• Millions of harvested emails offered for sale

02. February - 2012

• Research: Google’s reCAPTCHA under fire
• Spamvertised ‘You have 1 lost message on Facebook’ campaign leads to pharmaceutical scams
• A peek inside the Smoke Malware Loader
• Researchers spot Citadel, a ZeuS crimeware variant
• Researchers intercept two client-side exploits serving malware campaigns
• Pharmaceutical scammers launch their own Web contest
• The United Nations hacked, Team Poison claims responsibility
• Report: Internet Explorer 9 leads in socially-engineered malware protection
• Twitter adds HTTPS support by default
• Spamvertised “Hallmark ecard” campaign leads to malware
• Report: 3,325% increase in malware targeting the Android OS
• Why relying on antivirus signatures is simply not enough anymore
• Researchers intercept malvertising campaign using Yahoo’s ad network
• A peek inside the Ann Malware Loader
• Spamvertised ‘Termination of your CPA license’ campaign serving client-side exploits
• How cybercriminals monetize malware-infected hosts
• A peek inside the Elite Malware Loader
• BlackHole exploit kits gets updated with new features

03. March - 2012

• New service converts malware-infected hosts into anonymization proxies
• Spamvertised ‘Temporary Limit Access To Your Account’ emails lead to Citi phishing emails
• A peek inside the Darkness (Optima) DDoS Bot
• Research: proper screening could have prevented 67% of abusive domain registrations
• Spamvertised ‘Your accountant license can be revoked’ emails lead to client-side exploits and malware
• Spamvertised ‘Google Pharmacy’ themed emails lead to pharmaceutical scams
• Research: U.S accounts for 72% of fraudulent pharmaceutical orders
• Millions of harvested U.S government and U.S military email addresses offered for sale
• Trojan Downloaders actively utilizing Dropbox for malware distribution
• Spamvertised ‘Your tax return appeal is declined’ emails serving client-side exploits and malware
• Malicious USPS-themed emails circulating in the wild
• Spamvertised LinkedIn notifications serving client-side exploits and malware
• Tens of thousands of web sites affected in ongoing mass SQL injection attack
• Spamvertised Verizon-themed ‘Your Bill Is Now Available’ emails lead to ZeuS crimeware
• Spamvertised ‘Scan from a Hewlett-Packard ScanJet’ emails lead to client-side exploits and malware

04. April - 2012

• Email hacking for hire going mainstream – part two
• Spamvertised ‘US Airways’ themed emails serving client-side exploits and malware
• New underground service offers access to hundreds of hacked PCs
• New DIY email harvester released in the wild

05. May - 2012

• Managed SMS spamming services going mainstream
• A peek inside a boutique cybercrime-friendly E-shop
• Cybercriminals release ‘Sweet Orange’ – new web malware exploitation kit
• Spamvertised ‘Pizzeria Order Details’ themed campaign serving client-side exploits and malware
• Poison Ivy trojan spreading across Skype
• A peek inside a managed spam service
• Ongoing ‘LinkedIn Invitation’ themed campaign serving client-side exploits and malware
• Spamvertised bogus online casino themed emails serving adware
• Spamvertised ‘YouTube Video Approved’ and ‘Twitter Support” themed emails lead to pharmaceutical scams
• A peek inside a boutique cybercrime-friendly E-shop – part two
• Spamvertised CareerBuilder themed emails serving client-side exploits and malware
• Pop-ups at popular torrent trackers serving W32/Casonline adware
• ‘Windstream bill’ themed emails serving client-side exploits and malware

06. June - 2012

• Cybercriminals infiltrate the music industry by offering full newly released albums for just $1
• A peek inside a boutique cybercrime-friendly E-shop – part three
• DDoS for hire services offering to ‘take down your competitor’s web sites’ going mainstream
• Skype propagating Trojan targets Syrian activists
• Spamvertised ‘UPS Delivery Notification’ emails serving client-side exploits and malware
• Spamvertised ‘DHL Package delivery report’ emails serving malware
• Spamvertised ‘Your Amazon.com order confirmation’ emails serving client-side exploits and malware
• Cybercriminals populate Scribd with bogus adult content, spread malware using Comodo Backup
• Spamvertised ‘Your Paypal Ebay.com payment’ emails serving client-side exploits and malware
• ‘Create a Cartoon of You” ads serving MyWebSearch toolbar
• Spamvertised ‘Your UPS delivery tracking’ emails serving client-side exploits and malware
• Spamvertised ‘Confirm PayPal account” notifications lead to phishing sites
• Spamvertised ‘DHL Express Parcel Tracking Notification’ emails serving malware
• Spamvertised bogus online casino themed emails serving W32/Casonline

07. July - 2012

• Cybercriminals launch managed SMS flooding services
• 117,000 unique U.S visitors offered for malware conversion
• Phishing campaign targeting Gmail, Yahoo, AOL and Hotmail spotted in the wild
• What’s the underground market’s going rate for a thousand U.S based malware infected hosts?
• Spamvertised American Airlines themed emails lead to Black Hole exploit kit
• Online dating scam campaign currently circulating in the wild
• New Russian service sells access to compromised social networking accounts
• Cybercriminals impersonate UPS in client-side exploits and malware serving spam campaign
• Russian Ask.fm spamming tool spotted in the wild
• Spamvertised Intuit themed emails lead to Black Hole exploit kit
• Cybercriminals impersonate Booking.com, serve malware using bogus ‘Hotel Reservation Confirmation’ themed emails
• Spamvertised Craigslist themed emails lead to Black Hole exploit kit
• Cybercriminals impersonate law enforcement, spamvertise malware-serving ‘Speeding Ticket’ themed emails
• Spamvertised ‘Download your USPS Label’ themed emails serve malware
• Cybercriminals target Twitter, spread thousands of exploits and malware serving tweets
• Russian spammers release Skype spamming tool
• Spamvertised ‘Your Ebay funds are cleared’ themed emails lead to Black Hole exploit kit

08. August - 2012

• Spamvertised AICPA themed emails lead to Black Hole exploit kit
• Spamvertised ‘PayPal has sent you a bank transfer’ themed emails lead to Black Hole exploit kit
• Ongoing spam campaign impersonates LinkedIn, serves exploits and malware
• Millions of spamvertised emails lead to W32/Casonline
• Cybercriminals impersonate AT&T’s Billing Service, serve exploits and malware
• IRS themed spam campaign leads to Black Hole exploit kit
• Cybercriminals spamvertise bogus greeting cards, serve exploits and malware
• Spamvertised ‘Federal Tax Payment Rejected’ themed emails lead to Black Hole exploit kit
• Spamvertised ‘Fwd: Scan from a Hewlett-Packard ScanJet’ emails lead to Black Hole exploit kit
• Spamvertised ‘Royal Mail Shipping Advisory’ themed emails serve malware
• Cybercriminals impersonate Intuit Market, mass mail millions of exploits and malware serving emails
• Cybercriminals spamvertise PayPay themed ‘Notification of payment received’ emails, serve malware
• Cybercriminals impersonate UPS, serve malware

09. September - 2012

• Spamvertised ‘Wire Transfer Confirmation’ themed emails lead to Black Hole exploit kit
• Intuit themed ‘QuickBooks Update: Urgent’ emails lead to Black Hole exploit kit
• Cybercriminals resume spamvertising bogus greeeting cards, serve exploits and malware
• Cybercriminals abuse Skype’s SMS sending feature, release DIY SMS flooders
• New Russian service sells access to thousands of automatically registered accounts
• Spamvertised ‘Your Fedex invoice is ready to be paid now’ themed emails lead to Black Hole Exploit kit
• New Russian DIY SMS flooder using ICQ’s SMS sending feature spotted in the wild
• Spamvertised ‘US Airways reservation confirmation’ themed emails serve exploits and malware
• Cybercriminals impersonate FDIC, serve client-side exploits and malware
• Managed Ransomware-as-a-Service spotted in the wild
• A peek inside a boutique cybercrime-friendly E-shop – part four
• New E-shop selling stolen credit cards data spotted in the wild
• From Russia with iPhone selling affiliate networks
• New Russian DIY DDoS bot spotted in the wild

10. October - 2012

• New Russian DIY DDoS bot spotted in the wild
• Recently launched E-shop sells access to hundreds of hacked PayPal accounts
• New Russian service sells access to compromised Steam accounts
• ‘Vodafone Europe: Your Account Balance’ themed emails serve malware
• Cybercriminals impersonate UPS, serve client-side exploits and malware
• ‘Your video may have illegal content’ themed emails serve malware
• Cybercriminals spamvertise ‘Amazon Shipping Confirmation’ themed emails, serve client-side exploits and malware
• American Airlines themed emails lead to the Black Hole Exploit Kit
• Bogus Facebook notifications lead to malware
• Spamvertised ‘KLM E-ticket’ themed emails serve malware
• ‘Intuit Payroll Confirmation inquiry’ themed emails lead to the Black Hole exploit kit
• Malware campaign spreading via Facebook direct messages spotted in the wild
• ‘Regarding your Friendster password’ themed emails lead to Black Hole exploit kit
• Russian cybercriminals release new DIY DDoS malware loader
• PayPal ‘Notification of payment received’ themed emails serve malware
• Cybercriminals impersonate Delta Airlines, serve malware
• ‘Your UPS Invoice is Ready’ themed emails serve malware
• Bogus Skype ‘Password successfully changed’ notifications lead to malware
• Cybercriminals impersonate Verizon Wireless, serve client-side exploits and malware
• Spamvertised ‘BT Business Direct Order’ themed emails lead to malware
• Cybercriminals spamvertise millions of British Airways themed e-ticket receipts, serve malware
• Cybercriminals spamvertise millions of bogus Facebook notifications, serve malware
• Nuclear Exploit Pack goes 2.0

11. November - 2012

• BofA ‘Online Banking Passcode Reset’ themed emails serve client-side exploits and malware
• ‘ADP Immediate Notification’ themed emails lead to Black Hole Exploit Kit
• USPS ‘Postal Notification’ themed emails lead to malware
• ‘Fwd: Scan from a Xerox W. Pro’ themed emails lead to Black Hole Exploit Kit
• ‘Your Discover Card Services Blockaded’ themed emails serve client-side exploits and malware
• ‘Payroll Account Holded by Intuit’ themed emails lead to Black Hole Exploit Kit
• ‘American Express Alert: Your Transaction is Aborted’ themed emails serve client-side exploits and malware
• Cybercriminals abuse major U.S SMS gateways, release DIY Mail-to-SMS flooders
• ‘PayPal Account Modified’ themed emails lead to Black Hole Exploit Kit
• Bogus Better Business Bureau themed notifications serve client-side exploits and malware
• Cybercriminals spamvertise bogus eFax Corporate delivery messages, serve multiple malware variants
• Bogus IRS ‘Your tax return appeal is declined’ themed emails lead to malware
• ‘Copies of Missing EPLI Policies’ themed emails lead to Black Hole Exploit Kit
• Cybercriminals spamvertise bogus ‘Microsoft License Orders’ serve client-side exploits and malware
• Cybercriminals resume spamvertising ‘Payroll Account Cancelled by Intuit’ themed emails, serve client-side exploits and malware
• Cybercriminals spamvertise millions of FDIC ‘Your activity is discontinued’ themed emails, serve client-side exploits and malware
• Cybercriminals release stealthy DIY mass iFrame injecting Apache 2 modules
• Multiple ‘Inter-company’ invoice themed campaigns serve malware and client-side exploits
• Bogus Facebook ‘pending notifications’ themed emails serve client-side exploits and malware
• Cybercriminals target U.K users with bogus ‘Pay by Phone Parking Receipts’ serve malware
• Bogus DHL ‘Express Delivery Notifications’ serve malware
• Cybercriminals impersonate Vodafone U.K, spread malicious MMS notifications
• Cybercriminals impersonate T-Mobile U.K, serve malware
• Bogus ‘Meeting Reminder” themed emails serve malware
• Bogus ‘Intuit Software Order Confirmations’ lead to Black Hole Exploit Kit
• Bogus ‘End of August Invoices’ themed emails serve malware and client-side exploits

12. December - 2012

• DIY malicious domain name registering service spotted in the wild
• Fake ‘FedEx Tracking Number’ themed emails lead to malware
• Bogus ‘Facebook Account Cancellation Request’ themed emails serve client-side exploits and malware
• Malicious ‘Security Update for Banking Accounts’ emails lead to Black Hole Exploit Kit
• A peek inside a boutique cybercrime-friendly E-shop – part five
• Fake ‘Flight Reservation Confirmations’ themed emails lead to Black Hole Exploit Kit
• Malicious ‘Sendspace File Delivery Notifications’ lead to Black Hole Exploit Kit
• Fake Chase ‘Merchant Billing Statement’ themed emails lead to malware
• Cybercriminals entice potential cybercriminals into purchasing bogus credit cards data
• Fake ‘Change Facebook Color Theme’ events lead to rogue Chrome extensions
• Fake ‘Citi Account Alert’ themed emails lead to Black Hole Exploit Kit
• Spamvertised ‘Work at Home” scams impersonating CNBC spotted in the wild
• Pharmaceutical scammers spamvertise YouTube themed emails, entice users into purchasing counterfeit drugs
• Cybercriminals resume spamvertising British Airways themed E-ticket receipts, serve malware
• Fake ‘UPS Delivery Confirmation Failed’ themed emails lead to Black Hole Exploit Kit

12. January - 2013

• Spamvertised ‘Your Recent eBill from Verizon Wireless’ themed emails serve client-side exploits and malware
• Fake BBB (Better Business Bureau) Notifications lead to Black Hole Exploit Kit
• ‘Attention! Changes in the bank reports!’ themed emails lead to Black Hole Exploit Kit
• Fake ‘You have made an Ebay purchase’ themed emails lead to client-side exploits and malware
• A peek inside a boutique cybercrime-friendly E-shop – part six
• Black Hole Exploit Kit author’s ‘vertical market integration’ fuels growth in malicious Web activity
• Spamvertised AICPA themed emails serve client-side exploits and malware
• ‘Please confirm your U.S Airways online registration’ themed emails lead to Black Hole Exploit Kit
• Malicious DIY Java applet distribution platforms going mainstream
• Fake ‘ADP Speedy Notifications’ lead to client-side exploits and malware
• Cybercriminals release automatic CAPTCHA-solving bogus Youtube account generating tool
• ‘Batch Payment File Declined’ EFTPS themed emails lead to Black Hole Exploit Kit
• Cybercriminals resume spamvertising fake Vodafone ‘A new picture or video message’ themed emails, serve malware
• Leaked DIY malware generating tool spotted in the wild
• Email hacking for hire going mainstream – part three
• Android malware spreads through compromised legitimate Web sites
• Fake Intuit ‘Direct Deposit Service Informer’ themed emails lead to Black Hole Exploit Kit
• Fake LinkedIn ‘Invitation Notifications’ themed emails lead to client-side exploits and malware
• Novice cybercriminals experiment with DIY ransomware tools
• Bogus ‘Your Paypal Transaction Confirmation’ themed emails lead to Black Hole Exploit Kit
• Fake ‘FedEx Online Billing – Invoice Prepared to be Paid’ themed emails lead to Black Hole Exploit Kit
• A peek inside a DIY password stealing malware
• Malicious ‘Facebook Account Cancellation Request” themed emails serve client-side exploits and malware

12. February - 2013

• Fake Booking.com ‘Credit Card was not Accepted’ themed emails lead to malware
• Fake FedEx ‘Tracking ID/Tracking Number/Tracking Detail’ themed emails lead to malware
• ‘Your Kindle e-book Amazon receipt’ themed emails lead to Black Hole Exploit Kit
• New DIY HTTP-based botnet tool spotted in the wild
• Mobile spammers release DIY phone number harvesting tool
• New underground service offers access to thousands of malware-infected hosts
• Targeted ‘phone ring flooding’ attacks as a service going mainstream
• Fake ‘You’ve blocked/disabled your Facebook account’ themed emails serve client-side exploits and malware
• Spamvertised IRS ‘Income Tax Refund Turned Down’ themed emails lead to Black Hole Exploit Kit
• Malware propagates through localized Facebook Wall posts
• Malicious ‘RE: Your Wire Transfer’ themed emails serve client-side exploits and malware
• New underground E-shop offers access to hundreds of hacked PayPal accounts
• Fake ‘Verizon Wireless Statement” themed emails lead to Black Hole Exploit Kit
• DIY malware cryptor as a Web service spotted in the wild
• Malicious ‘Data Processing Service’ ACH File ID themed emails serve client-side exploits and malware
• How mobile spammers verify the validity of harvested phone numbers
• How much does it cost to buy 10,000 U.S.-based malware-infected hosts?

13. March - 2013

• New DIY IRC-based DDoS bot spotted in the wild
• Cybercriminals release new Java exploits centered exploit kit
• Segmented Russian “spam leads” offered for sale
• New DIY hacked email account content grabbing tool facilitates cyber espionage on a mass scale
• New DIY unsigned malicious Java applet generating tool spotted in the wild
• Commercial Steam ‘information harvester/mass group inviter’ could lead to targeted fraudulent campaigns
• Fake BofA CashPro ‘Online Digital Certificate” themed emails lead to malware
• Spamvertised BBB ‘Your Accreditation Terminated” themed emails lead to Black Hole Exploit Kit
• New ZeuS source code based rootkit available for purchase on the underground market
• Cybercriminals resume spamvertising ‘Re: Fwd: Wire Transfer’ themed emails, serve client-side exploits and malware
• ‘ADP Package Delivery Notification’ themed emails lead to Black Hole Exploit Kit
• Cybercrime-friendly community branded HTTP/SMTP based keylogger spotted in the wild
• Hacked PCs as ‘anonymization stepping-stones’ service operates in the open since 2004
• Fake ‘CNN Breaking News Alerts’ themed emails lead to Black Hole Exploit Kit
• Spotted: cybercriminals working on new Western Union based ‘money mule management’ script
• Malicious ‘BBC Daily Email’ Cyprus bailout themed emails lead to Black Hole Exploit Kit
• ‘ADP Payroll Invoice’ themed emails lead to malware
• ‘Terminated Wire Transfer Notification/ACH File ID” themed malicious campaigns lead to Black Hole Exploit Kit
• New DIY RDP-based botnet generating tool leaks in the wild
• A peek inside the EgyPack Web malware exploitation kit

14. April - 2013

• DIY Java-based RAT (Remote Access Tool) spotted in the wild
• Spamvertised ‘Re: Changelog as promised’ themed emails lead to malware
• Cybercrime-friendly service offers access to tens of thousands of compromised accounts
• Madi/Mahdi/Flashback OS X connected malware spreading through Skype
• Cybercriminals selling valid ‘business card’ data of company executives across multiple verticals
• A peek inside the ‘Zerokit/0kit/ring0 bundle’ bootkit
• DIY Skype ring flooder offered for sale
• Spamvertised ‘Your order for helicopter for the weekend’ themed emails lead to malware
• A peek inside a ‘life cycle aware’ underground market ad for a private keylogger
• American Airlines ‘You can download your ticket’ themed emails lead to malware
• Cybercriminals offer spam-friendly SMTP servers for rent
• How mobile spammers verify the validity of harvested phone numbers – part two
• A peek inside a (cracked) commercially available RAT (Remote Access Tool)
• DIY Russian mobile number harvesting tool spotted in the wild
• DIY SIP-based TDoS tool/number validity checker offered for sale
• CAPTCHA-solving Russian email account registration tool helps facilitate cybercrime
• Historical OSINT – The ‘Boston Marathon explosion’ and ‘Fertilizer plant explosion in Texas’ themed malware campaigns
• Fake ‘DHL Delivery Report’ themed emails lead to malware
• Cybercriminals impersonate Bank of America (BofA), serve malware
• How fraudulent blackhat SEO monetizers apply Quality Assurance (QA) to their DIY doorway generators
• Managed ‘Russian ransomware’ as a service spotted in the wild

15. May - 2013

• FedWire ‘Your Wire Transfer’ themed emails lead to malware
• A peek inside a CVE-2013-0422 exploiting DIY malicious Java applet generating tool
• New IRC/HTTP based DDoS bot wipes out competing malware
• New version of DIY Google Dorks based mass website hacking tool spotted in the wild
• Citibank ‘Merchant Billing Statement’ themed emails lead to malware
• Fake Amazon ‘Your Kindle E-Book Order’ themed emails circulating in the wild, lead to client-side exploits and malware
• Cybercriminals impersonate New York State’s Department of Motor Vehicles (DMV), serve malware
• Cybercriminals offer HTTP-based keylogger for sale, accept Bitcoin
• Newly launched E-shop for hacked PCs charges based on malware ‘executions’
• New subscription-based ‘stealth Bitcoin miner’ spotted in the wild
• Fake ‘Free Media Player’ distributed via rogue ‘Adobe Flash Player HD’ advertisement
• New versatile and remote-controlled “Android.MouaBot” malware found in the wild
• Newly launched ‘Magic Malware’ spam campaign relies on bogus ‘New MMS’ messages
• Commercial ‘form grabbing’ rootkit spotted in the wild
• DIY malware cryptor as a Web service spotted in the wild – part two
• CVs and sensitive info soliciting email campaign impersonates NATO
• New commercially available DIY invisible Bitcoin miner spotted in the wild
• Fake ‘Export License/Payment Invoice’ themed emails lead to malware
• Compromised Indian government Web site leads to Black Hole Exploit Kit
• Cybercriminals resume spamvertising Citibank ‘Merchant Billing Statement’ themed emails, serve malware
• Marijuana-themed DDoS for hire service spotted in the wild
• Fake ‘Vodafone U.K Images’ themed malware serving spam campaign circulating in the wild

16. June - 2013

• Compromised FTP/SSH account privilege-escalating mass iFrame embedding platform released on the underground marketplace
• New E-shop sells access to thousands of hacked PCs, accepts Bitcoin
• Pharmaceutical scammers impersonate Facebook’s Notification System, entice users into purchasing counterfeit drugs
• iLivid ads lead to ‘Searchqu Toolbar/Search Suite’ PUA (Potentially Unwanted Application)
• Hacked Origin, Uplay, Hulu Plus, Netflix, Spotify, Skype, Twitter, Instagram, Tumblr, Freelancer accounts offered for sale
• Scammers impersonate the UN Refugee Agency (UNHCR), seek your credit card details
• Fake ‘Unsuccessful Fax Transmission’ themed emails lead to malware
• Tens of thousands of spamvertised emails lead to W32/Casonline
• Rogue ads lead to SafeMonitorApp Potentially Unwanted Application (PUA)
• How cybercriminals apply Quality Assurance (QA) to their malware campaigns before launching them
• Rogue ads target EU users, expose them to Win32/Toolbar.SearchSuite through the KingTranslate PUA
• New boutique iFrame crypting service spotted in the wild
• Rogue ‘Oops Video Player’ attempts to visually social engineer users, mimicks Adobe Flash Player’s installation process
• New E-Shop sells access to thousands of malware-infected hosts, accepts Bitcoin
• New subscription-based SHA256/Scrypt supporting stealth DIY Bitcoin mining tool spotted in the wild
• Rogue ‘Free Mozilla Firefox Download’ ads lead to ‘InstallCore’ Potentially Unwanted Application (PUA)
• SIP-based API-supporting fake caller ID/SMS number supporting DIY Russian service spotted in the wild
• Rogue ‘Free Codec Pack’ ads lead to Win32/InstallCore Potentially Unwanted Application (PUA)
• Self-propagating ZeuS-based source code/binaries offered for sale
• How cybercriminals create and operate Android-based botnets

17. July - 2013

• Cybercriminals experiment with Tor-based C&C, ring-3-rootkit empowered, SPDY form grabbing malware bot
• Deceptive ads targeting German users lead to the ‘W32/SomotoBetterInstaller’ Potentially Unwanted Application (PUA)
• Newly launched underground market service harvests mobile phone numbers on demand
• Novel ransomware tactic locks users’ PCs, demands that they participate in a survey to get the unlock code
• Spamvertised ‘Export License/Invoice Copy’ themed emails lead to malware
• Cybercriminals spamvertise tens of thousands of fake ‘Your Booking Reservation at Westminster Hotel’ themed emails, serve malware
• New commercially available mass FTP-based proxy-supporting doorway/malicious script uploading application spotted in the wild
• Fake ‘iGO4 Private Car Insurance Policy Amendment Certificate’ themed emails lead to malware
• Tens of thousands of spamvertised emails lead to the Win32/PrimeCasino PUA (Potentially Unwanted Application)
• Spamvertised ‘Vodafone U.K MMS ID/Fake Sage 50 Payroll’ themed emails lead to (identical) malware
• New commercially available Web-based WordPress/Joomla brute-forcing tool spotted in the wild
• Rogue ads targeting German users lead to Win32/InstallBrain PUA (Potentially Unwanted Application)
• Yet another commercially available stealth Bitcoin/Litecoin mining tool spotted in the wild
• Protected: Deceptive ‘Media Player Update’ ads expose users to the rogue ‘Video Downloader/Bundlore’ Potentially Unwanted Application (PUA)
• Newly launched ‘HTTP-based botnet setup as a service’ empowers novice cybercriminals with bulletproof hosting capabilities
• Fake ‘Copy of Vodafone U.K Contract/Your Monthly Vodafone Bill is Ready/New MMS Received’ themed emails lead to malware
• Rogue ads lead to the ‘Free Player’ Win32/Somoto Potentially Unwanted Application (PUA)
• How much does it cost to buy one thousand Russian/Eastern European based malware-infected hosts?
• Custom USB sticks bypassing Windows 7/8’s AutoRun protection measure going mainstream
• DIY commercially-available ‘automatic Web site hacking as a service’ spotted in the wild

18. August - 2013

• ‘Malware-infected hosts as stepping stones’ service offers access to hundreds of compromised U.S based hosts
• New ‘Hacked shells as a service’ empowers cybercriminals with access to high page rank-ed Web sites
• Fake ‘iPhone Picture Snapshot Message’ themed emails lead to malware
• Malicious Bank of America (BofA) ‘Statement of Expenses’ themed emails lead to client-side exploits and malware
• Cybercriminals spamvertise fake ‘O2 U.K MMS’ themed emails, serve malware
• One-stop-shop for spammers offers DKIM-verified SMTP servers, harvested email databases and training to potential customers
• Fake ‘Apple Store Gift Card’ themed emails serve client-side exploits and malware
• Newly launched managed ‘malware dropping’ service spotted in the wild
• Cybercrime-friendly underground traffic exchange helps facilitate fraudulent and malicious activity
• From Vietnam with tens of millions of harvested emails, spam-ready SMTP servers and DIY spamming tools
• DIY Craigslist email collecting tools empower spammers with access to fresh/valid email addresses
• Bulletproof TDS/Doorways/Pharma/Spam/Warez hosting service operates in the open since 2009
• DIY automatic cybercrime-friendly ‘redirectors generating’ service spotted in the wild
• Cybercriminals offer spam-ready SMTP servers for rent/direct managed purchase
• Cybercrime-friendly underground traffic exchanges help facilitate fraudulent and malicious activity – part two

19. September - 2013

• DIY malicious Android APK generating ‘sensitive information stealer’ spotted in the wild
• Web-based DNS amplification DDoS attack mode supporting PHP script spotted in the wild
• Managed Malicious Java Applets Hosting Service Spotted in the Wild
• Affiliate network for mobile malware impersonates Google Play, tricks users into installing premium-rate SMS sending rogue apps
• 419 advance fee fraudsters abuse CNN’s ‘Email This’ Feature, spread Syrian Crisis themed scams
• Cybercriminals offer anonymous mobile numbers for ‘SMS activation’, video tape the destruction of the SIM card on request
• Yet another ‘malware-infected hosts as anonymization stepping stones’ service offering access to hundreds of compromised hosts spotted in the wild
• Cybercriminals experiment with ‘Socks4/Socks5/HTTP’ malware-infected hosts based DIY DoS tool
• Cybercriminals sell access to tens of thousands of malware-infected Russian hosts
• Spamvertised “FDIC: Your business account” themed emails serve client-side exploits and malware
• Cybercriminals experiment with Android compatible, Python-based SQL injecting releases
• Newly launched E-shop offers access to hundreds of thousands of compromised accounts
• DIY commercial CAPTCHA-solving automatic email account registration tool available on the underground market since 2008
• Yet another subscription-based stealth Bitcoin mining tool spotted in the wild

20. October - 2013

• A peek inside a Blackhat SEO/cybercrime-friendly doorways management platform
• Newly launched ‘HTTP-based botnet setup as a service’ empowers novice cybercriminals with bulletproof hosting capabilities – part two
• ‘T-Mobile MMS message has arrived’ themed emails lead to malware
• DDoS for hire vendor ‘vertically integrates’ starts offering TDoS attack capabilities
• Commercially available Blackhat SEO enabled multi-third-party product licenses empowered VPSs spotted in the wild
• New cybercrime-friendly iFrames-based E-shop for traffic spotted in the wild
• Cybercriminals offer spam-friendly SMTP servers for rent – part two
• Newly launched VDS-based cybercrime-friendly hosting provider helps facilitate fraudulent/malicious online activity
• Fake ‘You have missed emails’ GMail themed emails lead to pharmaceutical scams
• Compromised Turkish Government Web site leads to malware
• Novice cyberciminals offer commercial access to five mini botnets
• Spamvertised T-Mobile ‘Picture ID Type:MMS” themed emails lead to malware
• Yet another Bitcoin accepting E-shop offering access to thousands of hacked PCs spotted in the wild
• Malicious ‘FW: File’ themed emails lead to malware
• Mass iframe injection campaign leads to Adobe Flash exploits
• Rogue ads lead to the ‘Mipony Download Accelerator/FunMoods Toolbar’ PUA (Potentially Unwanted Application)
• A peek inside the administration panel of a standardized E-shop for compromised accounts
• U.K users targeted with fake ‘Confirming your Sky offer’ malware serving emails
• New DIY compromised hosts/proxies syndicating tool spotted in the wild
• Rogue ads lead to the ‘EzDownloaderpro’ PUA (Potentially Unwanted Application)
• Fake ‘Scanned Image from a Xerox WorkCentre’ themed emails lead to malware
• Fake ‘Important: Company Reports’ themed emails lead to malware
• Cybercriminals release new commercially available Android/BlackBerry supporting mobile malware bot
• Fake WhatsApp ‘Voice Message Notification/1 New Voicemail’ themed emails lead to malware

21. November - 2013

• Google-dorks based mass Web site hacking/SQL injecting tool helps facilitate malicious online activity
• Deceptive ads lead to the SpyAlertApp PUA (Potentially Unwanted Application)
• Cybercriminals differentiate their ‘access to compromised PCs’ service proposition, emphasize on the prevalence of ‘female bot slaves’
• New vendor of ‘professional DDoS for hire service’ spotted in the wild
• Source code for proprietary spam bot offered for sale, acts as force multiplier for cybercrime-friendly activity
• Low Quality Assurance (QA) iframe campaign linked to May’s Indian government Web site compromise spotted in the wild
• Popular French torrent portal tricks users into installing the BubbleDock/Downware/DownloadWare PUA (Potentially Unwanted Application)
• Web site of Brazilian ‘Prefeitura Municipal de Jaqueira’ compromised, leads to fake Adobe Flash player
• Malicious multi-hop iframe campaign affects thousands of Web sites, leads to a cocktail of client-side exploits
• Vendor of TDoS products/services releases new multi-threaded SIP-based TDoS tool
• Cybercriminals spamvertise tens of thousands of fake ‘Sent from my iPhone’ themed emails, expose users to malware
• Fake ‘Annual Form (STD-261) – Authorization to Use Privately Owned Vehicle on State Business’ themed emails lead to malware
• ‘Newly released proxy-supporting Origin brute-forcing tools targets users with weak passwords’
• Fake WhatsApp ‘Voice Message Notification’ themed emails expose users to malware
• Cybercriminals impersonate HSBC through fake ‘payment e-Advice’ themed emails, expose users to malware
• Fake ‘MMS Gallery’ notifications impersonate T-Mobile U.K, expose users to malware
• Fake ‘October’s Billing Address Code’ (BAC) form themed spam campaign leads to malware

21. December - 2013

• Cybercrime-friendly VPN service provider pitches itself as being ‘recommended by Edward Snowden’
• Commercial Windows-based compromised Web shells management application spotted in the wild
• Compromised legitimate Web sites expose users to malicious Java/Symbian/Android “Browser Updates”
• Malicious multi-hop iframe campaign affects thousands of Web sites, leads to a cocktail of client-side exploits – part two
• How cybercriminals efficiently violate YouTube, Facebook, Twitter, Instagram, SoundCloud and Google+’s ToS
• Tumblr under fire from DIY CAPTCHA-solving, proxies-supporting automatic account registration tools
• Newly launched ‘HTTP-based botnet setup as a service’ empowers novice cybercriminals with bulletproof hosting capabilities – part three
• Cybercriminals offer fellow cybercriminals training in Operational Security (OPSEC)
• Fake ‘WhatsApp Missed Voicemail’ themed emails lead to pharmaceutical scams
• A peek inside the booming underground market for stealth Bitcoin/Litecoin mining tools
• Cybercrime Trends 2013 – Year in Review

22. January - 2014

• ‘Adobe License Service Center Order NR’ and ‘Notice to appear in court’ themed malicious spam campaigns intercepted in the wild
• Vendor of TDoS products resets market life cycle of well known 3G USB modem/GSM/SIM card-based TDoS tool
• New TDoS market segment entrant introduces 96 SIM cards compatible custom GSM module, positions itself as market disruptor
• DIY Python-based mass insecure WordPress scanning/exploting tool with hundreds of pre-defined exploits spotted in the wild
• Google’s reCAPTCHA under automatic fire from a newly launched reCAPTCHA-solving/breaking service
• Fully automated, API-supporting service, undermines Facebook and Google’s ‘SMS/Mobile number activation’ account registration process
• Newly launched managed ‘compromised/hacked accounts E-shop hosting as service’ standardizes the monetization process
• Newly released Web based DDoS/Passwords stealing-capable DIY botnet generating tool spotted in the wild
• Cybercriminals release new Web based keylogging system, rely on penetration pricing to gain market share

23. February - 2014

• Cybercriminals release Socks4/Socks5 based Alexa PageRank boosting application
• Market leading ‘standardized cybercrime-friendly E-shop’ service brings 2500+ boutique E-shops online
• Managed TeamViewer based anti-forensics capable virtual machines offered as a service
• Malicious campaign relies on rogue WordPress sites, leads to client-side exploits through the Magnitude exploit kit
• ‘Hacking for hire’ teams occupy multiple underground market segments, monetize their malicious ‘know how’
• DoubleClick malvertising campaign exposes long-run beneath the radar malvertising infrastructure
• Spamvertised ‘Image has been sent’ Evernote themed campaign serves client-side exploits
• Spamvertised ‘You received a new message from Skype voicemail service’ themed emails lead to Angler exploit kit

24. March - 2014

• Deceptive ads expose users to PUA.InstallBrain/PC Performer PUA (Potentially Unwanted Application)
• Managed Web-based 300 GB/s capable DNS amplification enabled malware bot spotted in the wild
• Commercial Windows-based compromised Web shells management application spotted in the wild – part two
• Multiple spamvertised bogus online casino themed campaigns intercepted in the wild
• 5M+ harvested Russian mobile numbers service exposes fraudulent infrastructure
• Socks4/Socks5 enabled hosts as a service introduces affiliate network based revenue sharing scheme
• A peek inside a modular, Tor C&C enabled, Bitcoin mining malware bot
• Managed anti-forensics IMEI modification services fuel growth in the non-attributable TDoS market segment
• Commercially available database of 52M+ ccTLD zone transfer domains spotted in the wild
• Deceptive ads expose users to the Adware.Linkular/Win32.SpeedUpMyPC.A PUAs (Potentially Unwanted Applications)
• DIY automatic cybercrime-friendly ‘redirector generating’ service spotted in the wild – part two
• Managed DDoS WordPress-targeting, XML-RPC API abusing service, spotted in the wild

24. May - 2014

• Legitimate software apps impersonated in a blackhat SEO-friendly PUA (Potentially Unwanted Application) serving campaign
• DIY cybercrime-friendly (legitimate) APK injecting/decompiling app spotted in the wild
• Malicious DIY Java applet distribution platforms going mainstream – part two
• Spamvertised ‘Error in calculation of your tax’ themed emails lead to malware
• A peek inside a subscription-based DIY keylogging based type of botnet/malware generating tool
• Spamvertised ‘Notification of payment received’ themed emails lead to malware
• Malicious JJ Black Consultancy ‘Computer Support Services’ themed emails lead to malware
• A peek inside a newly launched all-in-one E-shop for cybercrime-friendly services
• Long run compromised accounting data based type of managed iframe-ing service spotted in the wild

Enjoy!

Continue reading →

Seeking Investor Contact!

Dear blog readers, I'm currently seeking a investor contact regarding an upcoming security project and wanted to find out whether you might be aware of an investor that would be willing to invest in my upcoming security project?

I can be reached at dancho.danchev@hush.com Continue reading →

Dancho Danchev's Blog Going Private - Request Access

Dear blog readers, it's been several years since I last posted a quality update following my disappearance in 2010. I wanted to take the time and thank everyone including researchers and colleagues who participated in the search including colleagues and vendors who offered expertise and advice including possible career opportunity.

As I've recently launched InfoWar Monitor 2.0 I decided that the time has come for me to take my blog to a new level by offering proprietary invite-only commercial access to selected readers who request access. The access guarantees unlimited access to daily cybercrime research information security topics coverage including an unlimited supply of actionable threat intelligence research on a daily basis including access to InfoWar Monitor 2.0 security podcast subscription security mailing list security newsletter a closed security community and a hacker E-zine released by the community including unlimited access to proprietary research reports and articles.

How to request access?
Users interested in requesting access can approach me with the following details:

Name:
Position:
How long have you been reading my blog?
How much would you be willing to invest to obtain access on a monthly basis?

I can be reached at dancho.danchev@hush.com

Enjoy! Continue reading →

Summarizing Webroot's Threat Blog Posts for January - 2012

In this post I'll summarize Webroot Threat Blog Posts for January, 2012. Feel free to check out some of the latest research published at the blog here and consider subscribing to its RSS feed.

01. Cybercriminals generate malicious Java applets using DIY tools
02. A peek inside the uBot malware bot
03. Researchers intercept a client-side exploits serving malware campaign
04. How phishers launch phishing attacks
05. A peek inside the Umbra malware loader
06. How malware authors evade antivirus detection
07. Inside AnonJDB – a Java based malware distribution platforms for drive-by downloads
08. Zappos.com hacked, 24 million users affected
09. Inside a clickjacking/likejacking scam distribution platform for Facebook
10. A peek inside the Cythosia v2 DDoS Bot
11. A peek inside the PickPocket Botnet
12. Mass SQL injection attack affects over 200,000 URLs
13. Email hacking for hire going mainstream
14. Millions of harvested emails offered for sale Continue reading →

Security News - Safe Browsing protection from even more deceptive attacks - Commentary

Google's security initiatives, continue, indicating, the search engine market's leader, ambitions, towards, building, a vibrant, ecosystem, for, protecting, end users, from malicious attacks, and, further, position, the company, as, an emerging, leader, whose, activities, contribute, to the, overall security level, of the entire ecosystem.

External Link:

"Safe Browsing has been protecting over one billion people from traditional phishing attacks on the web for more than eight years. The threat landscape is constantly changing—bad actors on the web are using more and different types of deceptive behavior to trick you into performing actions that you didn’t intend or want, so we’ve expanded protection to include social engineering."

The latest, indication, of this, trend, is the company's, introduction, of, social engineering attack, warnings, fully capable, of preventing, widespread damage, and to prevent, a malicious attack, from taking, place, in the early stages, of the campaign. With malicious actors, continuing, to utilize, visual social engineering campaigns, to serve, malicious software, and potentially unwanted applications, compromising, the confidentiality, integrity, and, availability, of information, visual social engineering, will, continue, to represent, a growing attack vector, to be utilized, by malicious actors, that, needs, better, protective, mechanisms, on behalf, of ecosystem participants.

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Continue reading →

Introduction to Dancho Danchev's Infowar Monitor 2.0

Dear blog readers it's been quite some time since I last posted a quality update following my dissapearance in 2010. I wanted to express my gratitude to everyone who participated in the search including colleagues and companies and wanted to say thanks for taking your time and effort to keep track and follow my research and disappearance.
.

As I've been busy working on Dancho Danchev's Blog - Mind Streams of Information Security Knowledge Infowar Monitor 2.0 I wanted to let you know that I've recently resumed my Twitter account following a successful career at Webroot Inc. including a short-term venture at GroupSense following a successful launch of my own company called Disruptive Individuals and Threat Data - the World's Most Comprehensive Threats Database including the Obmonix Platform - The World's Most Comprehensive Sensor Network, including a possible book writing project including a successful cyber security consultancy and a possible career opportunity request.

Let's take the time and effort to elaborate on what exactly InfoWar Monitor 2.0 aims to achieve including a detailed explanation of some of the key features of the newly launched portal-based type of research-based Information Security and Cybercrime Research and Threat Intelligence gathering community. Users interested in contributing with content including blog contribution including partnership sponsorship and possible advertising requests can approach me at dancho.danchev@hush.com

01. What is Inforwar Monitor 2.0?
Inforwar Monitor 2.0 aims to build the World's largest and most comprehensive community for Information Security, threat intelligence gathering and cybercrime research. Managed and operated by Dancho Danchev the World's leading expert in Information Security and cybercrime research and threat intelligence gathering the community seeks to provide information data and knowledge to thousands of users globally.

Among the key features include:
- Daily Security News Coverage
- Information Security Videos
- Security and Hacking eBook
- Security Newsletter
- Information Security Podcast
- Security and Hacking E-Zine
- Security Mailing List
- Daily Intelligence Brief
- Closed Security Community

02. What is Disruptive Individuals?
Disruptive Individuals is a research-intensive data-driven company successfully establishing the world's largest snapshot of malicious cybercrime activity for the purpose of offering the industry the world's most versatile portfolio of malicious cybercrime-driven services successfully positioning itself as the world's leading provider of real-time intelligence-driven services and product portfolio including cybercrime-research data malicious activity profiling services and custom-tailored intelligence assessments successfully positioning the company as the world's leading provider of cybercrime-data driven research-intensive intelligence data-driven company.

03. What is the Obmonix Platform?
The Obmonix platform aims to build the World's most versatile and comprehensive sensor network for intercepting monitoring and responding to cybercrime and cyber jihad events successfully deploying a variety of proprietary sensor network based of honeypot appliances industry-wide partnership including the utilization of proprietary cybercrime and cyber jihad forum and community monitoring and infiltration campaigns successfully positioning the platform as the leading indicator for cybercrime and cyber jihad activity globally empowering the operator law enforcement and the security industry with then necessary tactics techniques and procedures (TTPs) for successfully responding and monitoring cybercrime and cyber jihad activity globally leading to successful launch of the Disruptive Individuals startup successfully serving the needs of the Intelligence Community, the security industry and law enforcement agencies globally successfully anticipating an emerging set of malicious and fraudulent tactics techniques and procedures successfully protecting millions of users globally.

04. What is Threat Data?
Threat Data is the industry's leading and most versatile JSON-capable threats database successfully empowering companies and security researchers with the necessary knowledge to stay ahead of current and emerging threats, further, positioning their company and enterprise on the top of its game.

- Russian Business Network coverage
- Koobface Botnet coverage
- Kneber Botnet coverage
- Hundreds of IOCs (Indicators of Compromise)
- Tactics Techniques and Procedures In-Depth Coverage
- Malicious and fraudulent infrastructure mapped and exposed
- Malicious and fraudulent Blackhat SEO coverage
- Malicious spam and phishing campaigns
- Malicious and fraudulent scareware campaigns
- Malicious and fraudulent money mule recruitment scams
- Malicious and fraudulent reshipping mule recruitment scams
- Web based mass attack compromise fraudulent and malicious campaigns
- Malicious and fraudulent client-side exploits serving campaigns

Potential users and clients interested in obtaining access to Threat Data including a possible trial and a sample can approach me at dancho.danchev@hush.com

Stay tuned! Continue reading →

Dissecting the Latest Koobface Facebook Campaign

The latest Koobface malware campaign at Facebook, is once again exposing a diverse ecosystem worth assessing in times of active migration to alternative ISPs tolerating or conveniently ignoring the malicious activities courtesy of their customers. The -- now removed -- binaries that the dropper was requesting were hosted at the American International Baseball Club in Vienna, indicating a compromise.

us.geocities .com/adanbates84/index.htm
lostart .info/js/js.js (79.132.211.51)
off34 .com/go/fb.php (79.132.211.51)
youtube-spyvideo .com/youtube_file.html (58.241.255.37)
ahdirz .com/movie1.php?id=638&n=teen (208.85.181.69)
top100clipz .com/m6/movie1.php?id=638&n=teen (208.85.181.67)
hq-vidz .com/movie1.php?id=638&n=teen (208.85.181.68)

The dropper then phones back home to : f071108 .com/fb/first.php (79.132.211.50) with the binaries hosted at a legitimate site that's been compromised :

aibcvienna.org/youtube/ bnsetup24.exe
aibcvienna.org/youtube/ tinyproxy.exe

Related fake Youtube domains participating :
catshof .com (79.132.211.51)
youtube-spy .info (94.102.60.119)
youtubehof .net (218.93.205.30)
youtube-spyvideo .com (58.241.255.37)
yyyaaaahhhhoooo.ocom .pl (67.15.104.83)
youtube-x-files .com (94.102.60.119)

The development of cybercrime platforms utilizing legitimate infrastructure only, has always been in the works. With spamming systems relying exclusively on the automatically registered email accounts at free web based providers, to the automatic bulk registration of hundreds of thousands of domains enjoying a particular domain registrar's weak anti-abuse policies, it would be interesting to monitor whether marginal thinking or improved OPSEC relying on compromised hosts will be favored in 2009.

Related posts:
Fake YouTube Site Serving Flash Exploits
Facebook Malware Campaigns Rotating Tactics
Phishing Campaign Spreading Across Facebook
Large Scale MySpace Phishing Attack
Update on the MySpace Phishing Campaign
MySpace Phishers Now Targeting Facebook
MySpace Hosting MySpace Phishing Profiles Continue reading →

Project Proposal - Cybercrime Research - Seeking Investment

Dear blog readers, I'm currently seeking an investment regarding a cybercrime research project with the project proposal available on request.

Approach me at dancho.danchev@hush.com Continue reading →

Book Proposal - Seeking Sponsorship - Publisher Contact

Dear blog readers, as I'm currently busy writing a book, I'm currently seeking a publisher contact, with the book proposal available on request.
 
Approach me at ddanchev@cryptogroup.net Continue reading →

New Mobile Malware Spotted in the Wild, Hundreds of Users Affected

We've recently, intercepted, a currently, circulating, malicious, spam, campaign, affecting, hundreds, of users, globally, potentially, exposing, the, confidentiality, availability, and, integrity, of, their, devices, to, a, multi-tude, of, malicious, software. Largely, relying, on, a, multi-tude, of social engineering, vectors, the, cybercriminals, behind, the, campaign, have, managed, to, successfully, impersonate, Adobe Flash Player, users, into, thinking, that, they're, visiting, a, legitimate, Web

site, on, their, way, to, infect, their, devices, relying, on, bogus "Please update Flash on your device", messages.

Over, the, last, couple, of, years, we've, been, monitoring, an, increase, in rogue Google Play, type, of, Android, applications, capable, rogue online Web sites, tricking, tens, of, thousands, of, users, on, a, daily, basis, into, installation, rogue, applications, largely, relying, on, a, multi-tude, of, social engineering, vectors. Next, to, rogue, online, Web, sites, we've, been, also, actively, monitoring, an, increase, in, compromised, Web sites, serving, malicious, software, potentially, exposing, the, confidentiality, availability, and, integrity, of, their, devices, to, a, multi-tude, of, malicious, software. We've, been, also, busy, monitoring, an, increase, in, ongoing, monetizing, of, hijacked, traffic, type, of, underground, market, traffic, exchanges, with, more, cybercriminals, successfully, monetizing, the, hijacked, traffic, while, earning, fraudulent, revenue, in the, process.

In, this, post, we'll, profile, the, malicious, campaign, provide, actionable, intelligence, on, the, infrastructure, behind, it, and, discuss, in-depth, the, tactics, techniques, and, procedures, of, the, cybercriminals, behind, it.

Related malicious MD5s known to have participated in the campaign:

MD5: 288ad03cc9788c0855d446e34c7284ea

Related malicious URLS known to have participated in the campaign:

hxxp://brutaltube4mobile.com - 37.1.200.202

hxxp://xxxvideotube.org - 5.45.112.27; 37.140.192.196; 184.82.244.166

Known to have responded to the same malicious C&C server IP (37.1.200.202), are, also, the following malicious domains:

hxxp://nudism-nudist.com

hxxp://yumail.site

hxxp://hot-images.xyz

hxxp://nudism-klub.com

hxxp://nudism-nudist.com

hxxp://family-naturism.org

hxxp://teen-nudism.com

hxxp://family-naturism.net

hxxp://teen-media.net

hxxp://01hosting.biz

hxxp://jp-voyeur.com

hxxp://link-protector.biz

hxxp://brutaltube4mobile.com

hxxp://adobeupdate.org

hxxp://australiamms.com

hxxp://brutaltube4mobile.com

hxxp://donttreadonmike.com

hxxp://german-torrent.com

hxxp://fondazion.com

hxxp://derechosmadre.org

hxxp://torsearch.net

hxxp://4mytelecharger55.net

hxxp://4mytelecharger66.net

hxxp://fondazion.net

hxxp://fondazion.org

hxxp://sevajug.org

hxxp://defilez2.net

hxxp://downloadfrance22.com

hxxp://derechosmadretierra.org

Related malicious MD5s, known, to, have, phoned, back, to, the, same, C&C server IPs (brutaltube4mobile.com - 37.1.200.202):

MD5: 18327d619484112f81dc7da4169ba088

MD5: 090f7349fef4e1624393383e145d5982

MD5: d2e3d9d0e599cfce1af8b2777c3a071a

Related malicious MD5s known to have phoned back to the same C&C server IP (xxxvideotube.org - 5.45.112.27; 37.140.192.196; 184.82.244.166):

MD5: 288ad03cc9788c0855d446e34c7284ea

Once executed a sample malware phones back to the following C&C server IPs:

hxxp://5.196.121.148

Related malicious MD5s known to have phoned back to the same C&C server IP (5.196.121.148):

MD5: 7bef1c5e0dcf5f6fd152c0723993e378

MD5: 10e6c3f050b24583abf708d6afb34db2

MD5: 5a122660a3d54d9221500224f103d7b0

Thanks, to, the, overall, availability, of, mobile, affiliate, network, type, of, monetization, vectors, we, expect, to, continue, observing, an, increase, in, mobile, malware, type, of, fraudulent, and, rogue, Web sites, serving, malicious, software, to, unsuspecting, users, internationally.

We'll, continue, monitoring, the, market, segment, for, mobile, malware, and, post, updated, as, soon, as, new, developments, take, place.

Continue reading →

Introducing Obmonix - The World's Most Comprehensive Sensor Network

The world's leading expert in the field of the security cybercrime research and threat intelligence gathering presents the World's Most Comprehensive Sensor Network for offensive cybercrime/cyberterrorism fighting introducing active sensor deployment cybercrime/cyberterrorism forum and dark-web infiltration launching the Disruptive Individuals startup successfully disrupting and undermining the cybercrime/cyberterrorism ecosystem.

What is the Obmonix Platform?
The Obmonix platform aims to build the World's most versatile and comprehensive sensor network for intercepting monitoring and responding to cybercrime and cyber jihad events successfully deploying a variety of proprietary sensor network based of honeypot appliances industry-wide partnership including the utilization of proprietary cybercrime and cyber jihad forum and community monitoring and infiltration campaigns successfully positioning the platform as the leading indicator for cybercrime and cyber jihad activity globally empowering the operator law enforcement and the security industry with then necessary tactics techniques and procedures (TTPs) for successfully responding and monitoring cybercrime and cyber jihad activity globally leading to successful launch of the Disruptive Individuals startup successfully serving the needs of the Intelligence Community, the security industry and law enforcement agencies globally successfully anticipating an emerging set of malicious and fraudulent tactics techniques and procedures successfully protecting millions of users globally.

How you can help and contribute?
Feel free to join the Indiegogo funds raising campaign and stay tuned for the associated perks.

Looking forward to receiving your response at disruptive.individuals@gmail.com

Stay tuned! Continue reading →

Historical OSINT - Mac OS X PornTube Malware Serving Domains

This summary is not available. Please click here to view the post. Continue reading →

Historical OSINT - Massive Black Hat SEO Campaign Spotted in the Wild

Cybercriminals continue actively launching fraudulent and malicious blackhat SEO campaigns further acquiring legitimate traffic for the purpose of converting it into malware-infected hosts further spreading malicious software potentially compromising the confidentiality availability and integrity of the targeted host to a multi-tude of malicious software.

We've recently intercepted a currently active malicious blackhat SEO campaign serving scareware to socially engineered users with the cybercriminals behind it earning fraudulent revenue largely relying on the utilization of an affiliate-network based revenue-sharing scheme.

In this post we'll profile the campaign, provide actionable intelligence on the infrastructure behind it, and discuss in-depth the tactics techniques and procedures of the cybercriminals behind it.

Known malicious domains known to have participated in the campaign:
hxxp://doremisan7.net?uid=213&pid=3&ttl=319455a3f86 - 67.215.238.189

Known malicious redirector known to have participated in the campaign:
hxxp://marketcoms.cn/?pid=123&sid=8ec7ca&uid=213&isRedirected=1 - 91.205.40.5 - Email: JeremyLRademacher@live.com

Related malicious domains known to have been parked within the same malicious IP (91.205.40.5):
hxxp://browsersafeon.com
hxxp://online-income2.cn
hxxp://applestore2.cn
hxxp://media-news2.cn
hxxp://clint-eastwood.cn
hxxp://stone-sour.cn
hxxp://marketcoms.cn
hxxp://fashion-news.cn

Known malicious domains known to have participated in the campaign:
hxxp://guard-syszone.net/?p=WKmimHVmaWyHjsbIo22EeXZe0KCfZlbVoKDb2YmHWJjOxaCbkX1%2Bal6orKWeYJWfZW
VilWWenGOIo6THodjXoGJdpqmikpVuaGVvZG1kbV%2FEkKE%3D - 206.53.61.73

hxxp://yourspywarescan15.com/scan1/?pid=123&engine=pXT3wjTuNjYzLjE3Ny4xNTMmdGltZT0xMjUxMYkNPAFO - 85.12.24.12

Sample detection rate for sample malware:
MD5: 3d448b584d52c6a6a45ff369d839eb06
MD5: 54f671bb9283bf4dfdf3c891fd9cd700

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - A Diversified Portfolio of Pharmacautical Scams Spotted in the Wild

Cybercriminals continue actively speading fraudulent and malicious campaigns potentially targeting the confidentiality availability and integrity of the targeted host to a multi-tude of malicious software further earning fraudulent revenue in the process of monetizing access to malware-infected hosts further spreading malicious and fraudulent campaigns potentially affecting hundreds of thousands of users globally.

We've recently came across to a currently active diversified portfolio of pharmaceutical scams with the cybercriminals behind it successfully earning fraudulent revenue in the process of monetizing access to malware-infected hosts including the active utilization of an affiliate-network based type of revenue sharing scheme.

In this post we'll profile the campaign, provide actionable intelligence, on the infrastructure behind it, and discuss in depth, the tactics techniques and procedures of the cybercriminals behind it.

hxxp://lightmcusic.com
hxxp://darkclosed.com
hxxp://raintable.com
hxxp://rainthing.com
hxxp://lamptrail.com
hxxp://rainopen.com
hxxp://newsmillion.com
hxxp://paintlamp.com
hxxp://newssilver.com
hxxp://singerspa.ru
hxxp://belllead.ru
hxxp://dealfence.ru
hxxp://beachpage.ru
hxxp://sweatybottle.ru
hxxp://superring.ru
hxxp://betaflash.ru
hxxp://petgal.ru
hxxp://beastball.ru
hxxp://chartarm.ru
hxxp://roomcoin.ru
hxxp://armsgun.ru
hxxp://keyhero.ru
hxxp://sisterlover.ru
hxxp://pitstops.ru
hxxp://ballnet.ru
hxxp://betacourt.ru
hxxp://moviecourt.ru
hxxp://bandrow.ru
hxxp://rainmcusic.com
hxxp://lightmcusic.com
hxxp://diskwind.com
hxxp://disklarge.com
hxxp://silverlarge.com
hxxp://totaldomainname.com
hxxp://mcusicmouse.com
hxxp://diskbig.com
hxxp://rainthing.com
hxxp://thunderhigh.com
hxxp://raintruck.com
hxxp://mcusictank.com
hxxp://diskdark.com
hxxp://thunderdark.com
hxxp://raintowel.com
hxxp://mcusicball.com
hxxp://diskwarm.com
hxxp://silverwarsm.com
hxxp://diskopen.com
hxxp://diskfashion.com
hxxp://goldlgs.com
hxxp://silverdarks.com
hxxp://silveropens.com
hxxp://goldapers.com
hxxp://goldslvers.com
hxxp://diskhot.com
hxxp://bluedrow.com
hxxp://flashdrow.com
hxxp://raindrow.com
hxxp://thunderdrow.com
hxxp://rainmcusic.com
hxxp://rainpen.com
hxxp://rainthing.com
hxxp://spotsoda.ru
hxxp://mediamultimedia.ru
hxxp://boozetuna.ru
hxxp://singerspa.ru
hxxp://eyepizza.ru
hxxp://ringmic.ru
hxxp://belllead.ru
hxxp://roselid.ru
hxxp://homemold.ru
hxxp://tuneworld.ru
hxxp://happendepend.ru
hxxp://fruitmind.ru
hxxp://groupmud.ru
hxxp://showbabe.ru
hxxp://juicetube.ru
hxxp://kidrace.ru
hxxp://zoomtrace.ru
hxxp://lawice.ru
hxxp://dealfence.ru
hxxp://wipeagree.ru
hxxp://coverimage.ru
hxxp://beachpage.ru
hxxp://waxylanguage.ru
hxxp://jazzedge.ru
hxxp://casemale.ru
hxxp://spotsoda.ru
hxxp://mediamultimedia.ru
hxxp://boozetuna.ru
hxxp://singerspa.ru
hxxp://eyepizza.ru
hxxp://kittyweb.ru
hxxp://bedrib.ru
hxxp://yourib.ru
hxxp://antthumb.ru
hxxp://ringmic.ru
hxxp://belllead.ru
hxxp://roselid.ru
hxxp://homemold.ru
hxxp://tuneworld.ru
hxxp://happendepend.ru
hxxp://fruitmind.ru
hxxp://groupmud.ru
hxxp://showbabe.ru
hxxp://juicetube.ru
hxxp://kidrace.ru
hxxp://zoomtrace.ru
hxxp://lawice.ru
hxxp://dealfence.ru
hxxp://wipeagree.ru
hxxp://coverimage.ru
hxxp://beachpage.ru
hxxp://waxylanguage.ru
hxxp://jazzedge.ru
hxxp://casemale.ru
hxxp://czarsale.ru
hxxp://sweatybottle.ru
hxxp://boxlane.ru
hxxp://rubyfire.ru
hxxp://radiohorse.ru
hxxp://sodakite.ru
hxxp://armissue.ru
hxxp://houraxe.ru
hxxp://smokeeye.ru
hxxp://anteye.ru
hxxp://salesbarf.ru
hxxp://shelfleg.ru
hxxp://superring.ru
hxxp://timematch.ru
hxxp://sewermatch.ru
hxxp://betaflash.ru
hxxp://wovenbath.ru
hxxp://imagebirth.ru
hxxp://shelfjack.ru
hxxp://ringmack.ru
hxxp://gigaknack.ru
hxxp://filetack.ru
hxxp://busybrick.ru
hxxp://giantdock.ru
hxxp://wormduck.ru
hxxp://roundtruck.ru
hxxp://labfolk.ru
hxxp://malespark.ru
hxxp://petgal.ru
hxxp://hitpal.ru
hxxp://beastball.ru
hxxp://baysmell.ru
hxxp://beachhill.ru
hxxp://giantpill.ru
hxxp://runtvenom.ru
hxxp://soaproom.ru
hxxp://chartarm.ru
hxxp://deedsum.ru
hxxp://firmcan.ru
hxxp://sofafan.ru
hxxp://chinqueen.ru
hxxp://lightpen.ru
hxxp://fishgain.ru
hxxp://shiptrain.ru
hxxp://canbin.ru
hxxp://roomcoin.ru
hxxp://caseion.ru
hxxp://miciron.ru
hxxp://metalcorn.ru
hxxp://roadbun.ru
hxxp://armsgun.ru
hxxp://landclown.ru
hxxp://weedego.ru
hxxp://kidsolo.ru
hxxp://waxsolo.ru
hxxp://hitpiano.ru
hxxp://keyhero.ru
hxxp://hitzero.ru
hxxp://ziptap.ru
hxxp://arealamp.ru
hxxp://sunnystamp.ru
hxxp://freeproshop.ru
hxxp://clanpup.ru
hxxp://silkyear.ru
hxxp://jarpeer.ru
hxxp://cobrariver.ru
hxxp://sisterlover.ru
hxxp://rocktower.ru
hxxp://yearshoes.ru
hxxp://grapefrogs.ru
hxxp://papercoins.ru
hxxp://pitstops.ru
hxxp://ginboss.ru
hxxp://greedpants.ru
hxxp://rulebat.ru
hxxp://kidssplat.ru
hxxp://havocfleet.ru
hxxp://ballnet.ru
hxxp://statezit.ru
hxxp://elfsalt.ru
hxxp://zooant.ru
hxxp://finksnot.ru
hxxp://bluffheart.ru
hxxp://wifechart.ru
hxxp://ladyskirt.ru
hxxp://betacourt.ru
hxxp://moviecourt.ru
hxxp://bluecourt.ru
hxxp://actbeast.ru
hxxp://waterfast.ru
hxxp://beachquest.ru
hxxp://passexist.ru
hxxp://rareyou.ru
hxxp://bandrow.ru
hxxp://applewax.ru
hxxp://rockpony.ru
hxxp://feetboy.ru
hxxp://arguebury.ru
hxxp://chairchevy.ru
hxxp://birthsea.com
hxxp://sourcegood.com
hxxp://lamplarsge.com
hxxp://trailhuge.com
hxxp://raintable.com
hxxp://platepeople.com
hxxp://tablebig.com
hxxp://lampbig.com
hxxp://traillong.com
hxxp://whitebirth.com
hxxp://trailbirth.com
hxxp://tabledisk.com
hxxp://lampdissk.com
hxxp://trucktowel.com
hxxp://lamptrail.com
hxxp://trailwarm.com
hxxp://paperwarm.com
hxxp://lampwasrm.com
hxxp://birthocean.com
hxxp://trailocean.com
hxxp://rainopen.com
hxxp://lampfashion.com
hxxp://newsmillion.com
hxxp://trailsummer.com
hxxp://mcusicpaper.com
hxxp://lamppapser.com
hxxp://newssilver.com
hxxp://platedrops.com
hxxp://lampcups.com
hxxp://tablemindss.com
hxxp://tablecupss.com
hxxp://newssweet.com
hxxp://trailbasket.com
hxxp://trailgift.com
hxxp://goldblow.com
hxxp://truckdrow.com
hxxp://roverkey.com
hxxp://protopsite.ru
hxxp://frontstand.com
hxxp://greystand.com
hxxp://ballmind.com
hxxp://mindlarge.com
hxxp://windlarge.com
hxxp://darklarge.com
hxxp://balltable.com
hxxp://listplate.com
hxxp://frontblue.com
hxxp://lightskye.com
hxxp://balllong.com
hxxp://frontlong.com
hxxp://greylong.com
hxxp://largebisg.com
hxxp://greywalk.com
hxxp://minddark.com
hxxp://largedark.com
hxxp://balldisk.com
hxxp://largetrail.com
hxxp://balltrail.com
hxxp://largewarm.com
hxxp://skyewarm.com
hxxp://listlap.com
hxxp://flowlap.com
hxxp://frontstop.com
hxxp://ballsilver.com
hxxp://flowsilver.com
hxxp://jobsilvesr.com
hxxp://fastpads.com
hxxp://jobpeoples.com
hxxp://bluewaris.com
hxxp://joblaps.com
hxxp://listdrops.com
hxxp://flowchairs.com
hxxp://backgrass.com
hxxp://greygrass.com
hxxp://greyfront.com
hxxp://dropslist.com
hxxp://longgrey.com
hxxp://backgrey.com
hxxp://frontgrey.com
hxxp://hatroad.com
hxxp://hatweather.com
hxxp://hatcool.com
hxxp://weatherfloor.com
hxxp://drinkfloor.com
hxxp://hatbrowse.com
hxxp://roadbrowse.com
hxxp://roadinternet.com
hxxp://whiterdes.com
hxxp://hatcools.com
hxxp://hatbrowses.com
hxxp://hatflow.com
hxxp://hatride.com
hxxp://whitefloors.com
hxxp://hatducks.com
hxxp://whitebrwses.com
hxxp://hattables.com
hxxp://hatfloos.com
hxxp://hatdrinks.com
hxxp://blowlight.com
hxxp://longwrite.com
hxxp://bridelamp.com
hxxp://bridelong.com
hxxp://bridefast.com
hxxp://bridebottle.com
hxxp://longletter.com
hxxp://brideword.com
hxxp://bridetowel.com
hxxp://screenchairs.com
hxxp://boxscreens.com
hxxp://screenbirth.com
hxxp://touchcup.com
hxxp://boxboxs.com
hxxp://boxlams.com
hxxp://touchchair.com
hxxp://screencup.com
hxxp://lamptool.com
hxxp://touchbirth.com
hxxp://weathersand.com
hxxp://summerwarms.com
hxxp://summerwall.com
hxxp://weathersummer.com
hxxp://warmruns.com
hxxp://weathercold.com
hxxp://weatherwarm.com
hxxp://warmskye.com
hxxp://weatherskye.com
hxxp://weatheropens.com
hxxp://weatherocean.com
hxxp://weatherrun.com
hxxp://rovercorner.com
hxxp://rangepeople.com
hxxp://rangesand.com
hxxp://rangecorner.com
hxxp://rangespeed.com
hxxp://roverweather.com
hxxp://rangekey.com
hxxp://roverfast.com
hxxp://roverroad.com
hxxp://rangerange.com
hxxp://rovertrack.com
hxxp://rangetunes.com
hxxp://socketpaper.com
hxxp://trailgold.com
hxxp://booksocket.com
hxxp://brushtrail.com
hxxp://brushround.com
hxxp://brushchair.com
hxxp://brushsocket.com
hxxp://brushfast.com
hxxp://socketfast.com
hxxp://tablebrush.com
hxxp://brushpaper.com
hxxp://brushopen.com
hxxp://sockettrail.com
hxxp://socketround.com
hxxp://brushplane.com
hxxp://sourcebrush.com
hxxp://tabletrail.com
hxxp://truckblus.com

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - Google Sponsored Scareware Spotted in the Wild

Cybercriminals continue actively spreading malicious software while looking for alternative ways to acquire and monetize legitimate traffic successfully earning fraudulent revenue in the process of spreading malicious software.

We've recently came across to a Google Sponsored scareware campaign successfully enticing users into installing fake security software on their hosts further earning fraudulent revenue in the process of monetizing access to malware-infected hosts largely relying on the utilization of an affiliate-network based type of revenue sharing scheme.

In this post we'll profile the campaign, provide actionable intelligence, on the infrastructure, behind it and discuss in-depth, the tactics techniques and procedures of the cybercriminals behind it.

hxxp://www.google.com/aclk?sa=l&ai=Czd4NEnlLS-pWlrS1A-jBmIwO9pfjnQHOjKCvEI2B8woQAigIUPjA4pz8_____wFgyZajiqSkxBGgAabhse4DyAEBqgQhT9
CjnzChYHf5zQB4c8FB-fW9WUzgcUTQ4c7ciD4Gyxs0&num=5&sig=AGiWqty0Uq3Kr6U1Sb10olrq6C22JfNR_w&q=http://www.adwarepronow.com

hxxp://www.google.com/aclk?sa=L&ai=COLk5EnlLS-pWlrS1A-jBmIwO0YGZmwGz9aqwDbiw8bcBEAUoCFCnyNGE______8BYMmWo4qkpMQRyAEBqgQZT9
CTvAGhbX_5PQN_7QaAIk7HT3dQfrqLJQ&num=8amp;sig=AGiWqtyHmo4mgVkszSWtDUcT4dMRUAQnXg&q=http://www.antimalware-2010.com

Known malicious domains known to have participated in the campaign:
hxxp://www.adwarepronow.com/?gclid=CJ6d8LSGnZ8CFRMqagodmR_KaA - 209.216.193.112

Known malicious domains known to have participated in the campaign:
hxxp://www.antimalware-2010.com/ - 209.216.193.119

Sample detection rate for a sample malware:
MD5: 8328da91c8eba6668b3e72d547157ac7

Sample detection rate for a sample malware:
MD5: b74412ea403241c9c60482fd13540505

Once, executed, a, sample, malware, phones, back, to, the, following, malicious, C&C, server, IPs:
hxxp://72.167.164.199/definitions/configuration.txt
hxxp://72.167.164.199/latestversion/AntiMalwarePro_appversion.txt

We'll continue monitoring the campaign and post updates as soon as new developments take place. Continue reading →

Historical OSINT - A Diversified Portfolio of Fake Security Software

Cybercriminals, continue, actively, launching, malicious, and, fraudulent, campaigns, further, spreading, malicious, software, potentially, exposing, the, confidentiality, availability, and, integrity, of, the, targeted, host, to, a, multi-tude, of, malicious, software.

In, this, post, we'll, profile, a, currently, active, portfolio, of, fake, security, software, and, discuss, in-depth, the, tactics, techniques, and, procedures, of, the, cybercriminals, behind, it.

Known, to, have, responded, to, the, same, malicious, C&C, server, IPs (91.212.226.203; 94.228.209.195), are, also, the, following, malicious, domains:
hxxp://thebest-antivirus00.com
hxxp://virusscannerpro0.com
hxxp://lightandfastscanner01.com
hxxp://thebest-antivirus01.com
hxxp://thebestantivirus01.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://thebest-antivirus11.com
hxxp://antispyware-module1.com
hxxp://antispywaremodule1.com
hxxp://antivirus-toolsr1.com
hxxp://thebest-antivirus1.com
hxxp://thebest-antivirusx1.com
hxxp://thebestantivirus02.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://lightandfastscanner22.com
hxxp://prosecureprotection2.com
hxxp://virusscannerpro2.com
hxxp://antivirus-toolsr2.com
hxxp://thebest-antivirusx2.com
hxxp://thebestantivirus03.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://antispyware-module3.com
hxxp://antispywaremodule3.com
hxxp://virusscannerpro3.com
hxxp://windowsantivirusserver3.com
hxxp://thebest-antivirusx3.com
hxxp://thebestantivirus04.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://antispyware-scann4.com
hxxp://antivirus-toolsr4.com
hxxp://thebest-antivirusx4.com
hxxp://thebestantivirus05.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://thebest-antivirusx5.com
hxxp://remove-spyware-16.com
hxxp://lightandfastscanner66.com
hxxp://antispywaremodule6.com
hxxp://antispyware-module7.com
hxxp://antispywaremodule7.com
hxxp://antivirus-toolsr7.com
hxxp://antispyware-scann8.com
hxxp://pro-secure-protection8.com
hxxp://windowsantivirusserver8.com
hxxp://antispyware-module9.com
hxxp://antispywaremodule9.com
hxxp://antispyware-scann9.com
hxxp://virusscannerpro9.com
hxxp://antivirus-toolsr9.com
hxxp://thebest-antivirus9.com
hxxp://antiviruspro1scan.com
hxxp://antiviruspro2scan.com
hxxp://antiviruspro7scan.com
hxxp://antiviruspro8scan.com
hxxp://antiviruspro9scan.com
hxxp://antispyware6sacnner.com
hxxp://antivirusv1tools.com
hxxp://antispyware10windows.com
hxxp://antispyware20windows.com
hxxp://antivirus-toolsvv.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://prosecureprotection2.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://windowsantivirusserver3.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://remove-spyware-16.com
hxxp://pro-secure-protection8.com
hxxp://windowsantivirusserver8.com
hxxp://antivirus-toolsr9.com
hxxp://antivirusv1tools.com
hxxp://antispyware10windows.com
hxxp://antispyware20windows.com
hxxp://antivirus-toolsvv.com

Known, to, have, responded, to, the, same, malicious, C&C, server, IPs (94.228.209.195), are, also, the, following, malicious, domains:
hxxp://run-antivirusscan0.com
hxxp://runantivirusscan0.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://run-virus-scanner1.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://runantivirusscan3.com
hxxp://run-virusscanner3.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://run-virusscanner4.com
hxxp://remove-virus-15.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://remove-spyware-16.com
hxxp://run-virus-scanner6.com
hxxp://run-virusscanner6.com
hxxp://runantivirusscan8.com
hxxp://run-virus-scanner8.com
hxxp://windowsantivirusserver8.com
hxxp://run-virus-scanner9.com
hxxp://run-virusscanner9.com

Related, fraudulent, and, malicious, domains, known, to, have, participated, in, the, campaign:
hxxp://run-antivirusscan0.com
hxxp://run-antivirusscan1.com
hxxp://run-antivirusscan3.com
hxxp://run-antivirusscan6.com
hxxp://run-antivirusscan8.com
hxxp://runantivirusscan0.com
hxxp://runantivirusscan3.com
hxxp://runantivirusscan4.com
hxxp://runantivirusscan9.com
hxxp://securepro-antivirus1.com

Known, to, have, responded, to, the, same, malicious, C&C, server, IPs (91.212.226.203), are, also, the, following, malicious, domains:
hxxp://anti-virus-system0.com
hxxp://run-antivirusscan0.com
hxxp://runantivirusscan0.com
hxxp://perform-antivirus-scan-1.com
hxxp://remove-spyware-11.com
hxxp://remove-virus-11.com
hxxp://antivirus-system1.com
hxxp://performspywarescan1.com
hxxp://run-virus-scanner1.com
hxxp://remove-spyware-12.com
hxxp://remove-virus-12.com
hxxp://delete-all-virus-22.com
hxxp://antivirus-scanner-3.com
hxxp://remove-spyware-13.com
hxxp://remove-virus-13.com
hxxp://runantivirusscan3.com
hxxp://run-virusscanner3.com
hxxp://remove-spyware-14.com
hxxp://remove-virus-14.com
hxxp://gloriousantivirus2014.com
hxxp://run-virusscanner4.com
hxxp://smart-pcscanner05.com
hxxp://remove-virus-15.com
hxxp://remove-all-spyware-55.com
hxxp://delete-all-virus-55.com
hxxp://perform-virus-scan5.com
hxxp://perform-antivirus-scan-6.com
hxxp://antivirus-scanner-6.com
hxxp://remove-spyware-16.com
hxxp://run-virus-scanner6.com
hxxp://run-virusscanner6.com
hxxp://antivirus-scan-server6.com
hxxp://perform-antivirus-scan-7.com
hxxp://perform-antivirus-test-7.com
hxxp://antivirus-win-system7.com
hxxp://antivirus-for-pc-8.com
hxxp://perform-antivirus-scan-8.com
hxxp://perform-antivirus-test-8.com
hxxp://run-antivirusscan8.com
hxxp://runantivirusscan8.com
hxxp://run-virus-scanner8.com
hxxp://windowsantivirusserver8.com
hxxp://perform-antivirus-test-9.com
hxxp://perform-virus-scan9.com
hxxp://antispywareinfo9.com
hxxp://run-virus-scanner9.com
hxxp://run-virusscanner9.com
hxxp://antispyware06scan.com
hxxp://antispywareinfo9.com
hxxp://antivirus-for-pc-2.com
hxxp://antivirus-for-pc-4.com
hxxp://antivirus-for-pc-6.com
hxxp://antivirus-for-pc-8.com
hxxp://antiviruspro8scan.com
hxxp://extra-antivirus-scan1.com
hxxp://extra-security-scanb1.com
hxxp://run-antivirusscan0.com
hxxp://run-antivirusscan1.com
hxxp://run-antivirusscan3.com
hxxp://run-antivirusscan6.com
hxxp://run-antivirusscan8.com
hxxp://runantivirusscan0.com
hxxp://runantivirusscan3.com
hxxp://runantivirusscan4.com
hxxp://runantivirusscan9.com
hxxp://securepro-antivirus1.com
hxxp://super-scanner-2004.com
hxxp://top-rateanrivirus0.com
hxxp://topantimalware-scanner7.com

We'll, continue, monitoring, the, campaign, and, post, updates, as, soon, as, new, developments, take, place. Continue reading →

Historical OSINT - A Portfolio of Fake/Rogue Video Codecs

Shall we expose a huge domains portfolio of fake/rogue video codecs dropping the same Zlob variant on each and every of the domains, thereby acting as a great example of what malicious economies of scale means?

Currently active Zlob malware variants promoting sites:
hxxp://pornqaz.com
hxxp://uinsex.com
hxxp://qazsex.com
hxxp://sexwhite.net
hxxp://lightporn.net
hxxp://xeroporn.com
hxxp://brakeporn.net
hxxp://sexclean.net
hxxp://delfiporn.net
hxxp://pornfire.net
hxxp://redcodec.net
hxxp://democodec.com
hxxp://delficodec.com
hxxp://turbocodec.net
hxxp://gamecodec.com
hxxp://blackcodec.net
hxxp://xerocodec.com
hxxp://ixcodec.net
hxxp://codecdemo.com
hxxp://ixcodec.com
hxxp://citycodec.com
hxxp://codecthe.com
hxxp://codecnitro.com
hxxp://codecbest.com
hxxp://codecspace.com
hxxp://popcodec.net
hxxp://uincodec.com
hxxp://xhcodec.com
hxxp://stormcodec.net
hxxp://codecmega.com
hxxp://whitecodec.com
hxxp://jetcodec.com
hxxp://endcodec.com
hxxp://abccodec.com
hxxp://codecred.net
hxxp://cleancodec.com
hxxp://herocodec.com
hxxp://nicecodec.com

Related MD5s, known, to, have, participated, in, the, campaign:
MD5: 30965fdbd893990dd24abda2285d9edc

Why are the malicious parties so KISS oriented at the end of every campaign, compared to the complexity and tactical warfare tricking automated malware harvesting approaches within the beginning of the campaign? Because they're not even considering the possibility of proactively detecting the end of many other malware campaigns to come, which will inevitable be ending up to these domains. Continue reading →

Historical OSINT - A Portfolio of Exploits Serving Domains

With, the, rise, of, Web, malware, exploitation, kits, continuing, to, proliferate, cybercriminals, are, poised, to, continue, earning, fraudulent, revenue, in, the, process, of, monetizing, access, to, malware-infected, hosts, largely, relying, on, the, active,y utilization, of, client-side, exploits, further, spreaing, malicious, software, potentially, compromising, the, confidentiality, availability, and, integrity, of, the, targeted, host, to, a, multi-tude, of, malicious, software.

What, used, to, be, an, ecosystem, dominated, by, proprietary, DIY (do-it-yourself) malware and exploits, generating, tools, is, today's, modern, cybercrime, ecosystem, dominated, by, Web, malware, exploitation, kits, successfully, empowering, novice, cybercriminals, with, the, necessary, tactics, techniques, and, procedures, for, the, purpose, of, launching, a, fraudulent, and, malicious, campaign, potentially, affecting, hundreds, of, thousands, of, users, globally.

In, this, post, we'll, provide, actionable, intelligence, on, currently, active, IcePack, Web, malware, exploitation, kit, client-side, and, malware-exploits, serving, domains.

Related IcePack Web Malware Exploitation Kit domains:
hxxp://seateremok.com/xc/index.php
hxxp://lskdfjlerjvm.com/ice-pack/index.php  
hxxp://formidleren.dk/domain/mere.asp  
hxxp://webs-money.info/ice-pack/index.php  
hxxp://seateremok.com/xc/index.php
hxxp://greeetthh.com/ice-pack1/index.php
hxxp://58.65.235.153/~pozitive/ice/index.php
hxxp://iframe911.com/troy/us/sp/ice/index.php
hxxp://themusicmp3.info/rmpanfr/index.php

Related, malicious, MD5s, known, to, have, phoned, back, to, the, same, malicious, C&C, server, IPs (lskdfjlerjvm.com):
MD5: 4c0958f2f9f5ff2e5ac47e92d4006452
MD5: d955372c7ef939502c43a71ff1a9f76e
MD5: 118e24ea884d375dc9f63c986a15e5df
MD5: e825a7e975a9817441da9ba1054a3e6f
MD5: 71460d4a1c7c18ec672fed56d764ebe6

Once, executed, a, sample, malware (MD5: d955372c7ef939502c43a71ff1a9f76e), phones, back, to, the, following, malicious, C&C, server, IPs:
hxxp://riddenstorm.net - 208.100.26.234
hxxp://lordofthepings.ru - 109.70.26.37
hxxp://tableshown.net - 208.100.26.234
hxxp://leadshown.net
hxxp://tablefood.ru
hxxp://tablefood.net - 180.210.34.47
hxxp://leadfood.net
hxxp://tablemeet.net
hxxp://leadmeet.net
hxxp://pointneck.net
hxxp://pointshown.net
hxxp://callshown.net - 212.61.180.100
hxxp://callneck.ru
hxxp://callneck.net
hxxp://ringshown.ru
hxxp://ringshown.net
hxxp://noneshown.net

We'll, continue, monitoring, the, campaigns, and, post, updates, as, soon, as, new, developments, take, place. Continue reading →

New Mobile Malware Spotted in the Wild, Hundreds of Users Affected

We've, recently, intercepted, a, currently, circulating, malicious, mobile, malware, potentially, compromising, the, confidentiality, availability, and, integrity, of, the, compromised, devices, further, spreading, malicious, software, on, the, affected, devices, with, the, cybercriminals, behind, it, potentially, earning, fraudulent, revenue, in, the, process, of, monetizing, access, to, malware-infected, hosts, largely, relying, on, the, utilization, of, an, affiliate-network, based, type, of, revenue, sharing, scheme.

In, this, post, we'll, provide, actionable, intelligence, about, the, infrastructure, behind, it, discuss, in-depth, the, tactics, techniques, and, procedures, of, the, cybercriminals, behind, it, and, further, expand, the, malicious, infrastructure, behind, the, campaign, successfully, exposing, the, malicious, actors, behind, it.

Related, malicious, MD5s, known, to, have, participated, in, the, campaign:
MD5: 12e6971511705b7396e4399ac46854f9
MD5: e7d6fef2f1b23cf39a49771eb277e697

Once, executed, a, sample, malware, phones, back, to, the, following, malicious, C&C, server, IPs:
hxxp://61.160.234.133/date/getDate
hxxp://g.10086.cn/gamecms/wap/game/wyinfo/700144311000?channelId=12068000
hxxp://ccinchina.com
hxxp://117.135.133.9/source/appsource/15035916BaiduBrowser_Android_2-3-28-6_1000934d.apk?imei=
hxxp://117.135.131.9/push_4/push.action?imei=value
hxxp://61.160.242.35/pro_5/pro.action

Related, malicious, MD5s, known, to, have, phoned, back, to, the, same, malicious, C&C, server, IPs (61.160.234.133)
MD5: ec125a741919574b7de29889845fe648
MD5: 695db5f40c02fa4eaeda76882de6c1f8
MD5: 3281f34e42483b8a32f7a66dfed5a548
MD5: ccd0a5805a82fdccb3ebdbdc95b432e8
MD5: 07950552ddf728685b943254f390778d

Once, executed, a, sample, malware, phones, back, to, the, following, malicious, C&C, server, IPs:
hxxp://agoldcomm.plat96.com
hxxp://push7.devopenserv.com
hxxp://cloud6.uuserv10.com

g.10086.cn, is, known, to, have, responded, to, 112.4.19.33; 221.181.195.141; 58.68.142.6; 180.150.163.149; 58.68.142.188; 58.68.142.203; 60.217.242.152; 58.68.142.232; 60.217.242.151; 112.90.217.110; 58.68.142.182; 58.68.142.183; 60.217.232.201; 58.68.142.237;59.151.7.195

Related, malicious, MD5s, known, to, have, responded, to, the, same, malicious, C&C, server, IPs:
MD5: 15ddafe1b32dc0b476cdaac92cc3ea12
MD5: 60e7caba4395c77f88c72103aa3c14e2
MD5: 9c692a6b2fc5b0d9f468ce1a110bd296
MD5: 2beae563023a37559c3d0e2da577c517
MD5: d9f63c321e345b2b1c91a1259003cfed
MD5: 07950552ddf728685b943254f390778d

Related, malicious, domains, known, to, have, participated, in, the, campaign:
hxxp://log6.devopenserv.com - 211.151.167.51
hxxp://cloud6.devopenserv.com
hxxp://pus7.devopenserv.com

Related, malicious, MD5s, known, to, have, phoned, back, to, the, same, malicious, C&C, server, IPs:
MD5: 37845effed5d773252f129bd3fce588a
MD5: 08beb447853aae8655f77ddc16a5766b
MD5: 16147ec72345631cc345af69b2640578
MD5: 4fcedf07023619b21358c259d11a90cb
MD5: ab36173205aa7aeb713956b1f9ec7b26

Related, malicious, domains, known, to, have, participated, in, the, campaign:
hxxp://down.devopenserv.com
hxxp://cloud.devopenserv.com
hxxp://ck6.devopenserv.com
hxxp://rck6.devopenserv.com
hxxp://img14.devopenserv.com
hxxp://dl8.devopenserv.com
hxxp://dl14.devopenserv.com
hxxp://cloud6.devopenserv.com
hxxp://push7.devopenserv.com
hxxp://dp3.devopenserv.com
hxxp://cloud2.devopenserv.com
hxxp://ck2.devopenserv.com
hxxp://dp2.devopenserv.com

We'll, continue, monitoring, the, campaign, and, post, updates, as, soon, as, new, developments, take, place. Continue reading →