Summarizing ZDNet's Zero Day Posts for January

The following is a brief summary of all of my posts at ZDNet's Zero Day for January, 2013. You can subscribe to Zero Day's main feed, or follow me on Twitter:

01. Dutch security researchers dissect the Pobelka botnet
02. ESPN's ScoreCenter for iOS sends passwords in clear-text, susceptible to XSS flaw
03. Report: AutoRun malware infections continue topping the charts
04. Comparative review: Opera leads in browser anti-phishing protection
05. Italian-language page at MSN redirects to Cool Exploit Kit, serves ransomware
06. WordPress releases version 3.5.1, fixes 3 security issues
07. Targeted attack against UAE activist utilizes CVE-2013-0422, drops malware
 
This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Summarizing Webroot's Threat Blog Posts for December

The following is a brief summary of all of my posts at Webroot's Threat Blog for December, 2012. You can subscribe to Webroot's Threat Blog RSS Feed, or follow me on Twitter:

01. DIY malicious domain name registering service spotted in the wild
02. Fake ‘FedEx Tracking Number’ themed emails lead to malware
03. Bogus ‘Facebook Account Cancellation Request’ themed emails serve client-side exploits and malware
04. Malicious ‘Security Update for Banking Accounts’ emails lead to Black Hole Exploit Kit
05. A peek inside a boutique cybercrime-friendly E-shop – part five
06. Fake ‘Flight Reservation Confirmations’ themed emails lead to Black Hole Exploit Kit
07. Malicious ‘Sendspace File Delivery Notifications’ lead to Black Hole Exploit Kit
08. Fake Chase ‘Merchant Billing Statement’ themed emails lead to malware
09. Cybercriminals entice potential cybercriminals into purchasing bogus credit cards data
10. Fake ‘Change Facebook Color Theme’ events lead to rogue Chrome extensions
11. Fake ‘Citi Account Alert’ themed emails lead to Black Hole Exploit Kit
12. Spamvertised ‘Work at Home” scams impersonating CNBC spotted in the wild
13. Pharmaceutical scammers spamvertise YouTube themed emails, entice users into purchasing counterfeit drugs
14. Cybercriminals resume spamvertising British Airways themed E-ticket receipts, serve malware
15. Fake ‘UPS Delivery Confirmation Failed’ themed emails lead to Black Hole Exploit Kit
16. Webroot’s Threat Blog Most Popular Posts for 2012

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Raw Historical OSINT - Keeping Money Mule Recruiters on a Short Leash - Part Twelve

In the following (historical) intelligence brief, I'll provide you with some raw domain data of fake companies that are known to have attempted to recruit money mules over the past 2 years.

The domains listed here were registered by the same gang of cybercriminals that I've been extensively profiling in previous "Keeping Money Mule Recruiters on a Short Leash" posts.

Money mule recruitment domains:
compassllc-usa.com
linkllc-uk.com
very-compllc.com
click-n-art.com
infotechgroup-inc.com
amplitude-groupmain.tw
magnet-groupinc.cc
allston-groupsec.cc
DEVELOP-INC.COM
MERCYGROUPNET.NET
MERCY-INC.COM
SOLARISGROUPINC.COM
SOLARISGROUPNET.NET
JVC-INC.COM
JVCGROUPNET.NET
EVOLVINGSYSINC.NET
ATCANETWORKS.NET
ATCA-INC.COM
GALLEOGROUPNET.NET
GALLEO-INC.COM
EVOLVINGSYSINC.NET
EVOLVING-INC.COM
NETMARKET-INC.COM
NETMARKETTECH.NET
INFOTECH-GROUPCO.NET
INFOTECH-GROUPINC.COM
INFOTECHGROUP-INC.COM
BANDS-GROUPSVC.COM
BANDS-INC.COM
BANDSGROUP-INC.NET
BANDSGROUPNET.CC
ICT-GROUPCO.COM
ICT-GROUPSVC.NET
ICTGROUPINC.COM
ICTGROUPNET.CC
GIANT-GROUPCO.NET
GIANT-GROUPINC.COM
GIANT-GROUPNET.CC
GIANTGROUPINC.COM
IMPERIAL-GROUPINC.COM
IMPERIAL-GROUPSVC.NET
IMPERIALGROUPCO.COM
HOSTGROUP-INC.COM
HOSTGROUPINC.COM
HOSTGROUPNET.CC
HOST-GROUPSVC.NET
CNLGROUP-INC.CC
CNLGROUPNET.NET
CNL-GROUPSVC.COM
CNL-INC.COM
bands-groupsvc.com
bands-inc.com
bandsgroup-inc.net
bandsgroupnet.cc
cnl-groupsvc.com
cnl-inc.com
cnlgroup-inc.cc
cnlgroupnet.net
giant-groupco.net
giant-groupinc.com
giant-groupnet.cc
giantgroupinc.com
host-groupsvc.net
hostgroup-inc.com
hostgroupinc.com
hostgroupnet.cc
ict-groupco.com
ict-groupsvc.net
ictgroupinc.com
ictgroupnet.cc
imperial-groupinc.com
imperial-groupsvc.net
imperialgroupco.com
infotech-groupco.net
infotech-groupinc.com
infotechgroup-inc.com
itcom-groupco.net
itcom-groupfine.cc
itcom-groupsvc.com
itcomgroup-inc.com
mgm-groupsvc.com
mgmgroup-inc.net
mgmgroupinc.com
mgmgroupnet.cc
usi-groupinc.net
usigroup-inc.com
usigroupinc.com
usigroupnet.cc
NOVARIS-GROUPLLC.TW
NOVARISGROUPMAIN.TW
NOVARIS-GROUPORG.CC
VITAL-GROUPCO.CC
VITAL-GROUPCO.TW
VITAL-GROUPINC.TW
PERSEUS-GROUPFINE.TW
PERSEUS-GROUPINC.TW
PERSEUSGROUPLLC.CC

Consider going through my previous research into one of the most popular 'risk-forwarding' tactic used by cybercriminals, namely, money mule recruitment.

Related posts on money mule recruitment:
Keeping Money Mule Recruiters on a Short Leash - Part Eleven
Keeping Money Mule Recruiters on a Short Leash - Part Ten
Keeping Money Mule Recruiters on a Short Leash - Part Nine
Keeping Money Mule Recruiters on a Short Leash - Part Eight - Historical OSINT
Keeping Money Mule Recruiters on a Short Leash - Part Seven
Keeping Money Mule Recruiters on a Short Leash - Part Six
Keeping Money Mule Recruiters on a Short Leash - Part Five
The DNS Infrastructure of the Money Mule Recruitment Ecosystem
Keeping Money Mule Recruiters on a Short Leash - Part Four
Money Mule Recruitment Campaign Serving Client-Side Exploits
Keeping Money Mule Recruiters on a Short Leash - Part Three
Money Mule Recruiters on Yahoo!'s Web Hosting
Dissecting an Ongoing Money Mule Recruitment Campaign
Keeping Money Mule Recruiters on a Short Leash - Part Two
Keeping Reshipping Mule Recruiters on a Short Leash
Keeping Money Mule Recruiters on a Short Leash
Standardizing the Money Mule Recruitment Process
Inside a Money Laundering Group's Spamming Operations
Money Mule Recruiters use ASProx's Fast Fluxing Services
Money Mules Syndicate Actively Recruiting Since 2002

This post has been reproduced from Dancho Danchev's blog.

Raw Historical OSINT - Keeping Money Mule Recruiters on a Short Leash - Part Twelve

In the following (historical) intelligence brief, I'll provide you with some raw domain data of fake companies that are known to have attempted to recruit money mules over the past 2 years.

The domains listed here were registered by the same gang of cybercriminals that I've been extensively profiling in previous "Keeping Money Mule Recruiters on a Short Leash" posts.

Money mule recruitment domains:
compassllc-usa.com
linkllc-uk.com
very-compllc.com
click-n-art.com
infotechgroup-inc.com
amplitude-groupmain.tw
magnet-groupinc.cc
allston-groupsec.cc
DEVELOP-INC.COM
MERCYGROUPNET.NET
MERCY-INC.COM
SOLARISGROUPINC.COM
SOLARISGROUPNET.NET
JVC-INC.COM
JVCGROUPNET.NET
EVOLVINGSYSINC.NET
ATCANETWORKS.NET
ATCA-INC.COM
GALLEOGROUPNET.NET
GALLEO-INC.COM
EVOLVINGSYSINC.NET
EVOLVING-INC.COM
NETMARKET-INC.COM
NETMARKETTECH.NET
INFOTECH-GROUPCO.NET
INFOTECH-GROUPINC.COM
INFOTECHGROUP-INC.COM
BANDS-GROUPSVC.COM
BANDS-INC.COM
BANDSGROUP-INC.NET
BANDSGROUPNET.CC
ICT-GROUPCO.COM
ICT-GROUPSVC.NET
ICTGROUPINC.COM
ICTGROUPNET.CC
GIANT-GROUPCO.NET
GIANT-GROUPINC.COM
GIANT-GROUPNET.CC
GIANTGROUPINC.COM
IMPERIAL-GROUPINC.COM
IMPERIAL-GROUPSVC.NET
IMPERIALGROUPCO.COM
HOSTGROUP-INC.COM
HOSTGROUPINC.COM
HOSTGROUPNET.CC
HOST-GROUPSVC.NET
CNLGROUP-INC.CC
CNLGROUPNET.NET
CNL-GROUPSVC.COM
CNL-INC.COM
bands-groupsvc.com
bands-inc.com
bandsgroup-inc.net
bandsgroupnet.cc
cnl-groupsvc.com
cnl-inc.com
cnlgroup-inc.cc
cnlgroupnet.net
giant-groupco.net
giant-groupinc.com
giant-groupnet.cc
giantgroupinc.com
host-groupsvc.net
hostgroup-inc.com
hostgroupinc.com
hostgroupnet.cc
ict-groupco.com
ict-groupsvc.net
ictgroupinc.com
ictgroupnet.cc
imperial-groupinc.com
imperial-groupsvc.net
imperialgroupco.com
infotech-groupco.net
infotech-groupinc.com
infotechgroup-inc.com
itcom-groupco.net
itcom-groupfine.cc
itcom-groupsvc.com
itcomgroup-inc.com
mgm-groupsvc.com
mgmgroup-inc.net
mgmgroupinc.com
mgmgroupnet.cc
usi-groupinc.net
usigroup-inc.com
usigroupinc.com
usigroupnet.cc
NOVARIS-GROUPLLC.TW
NOVARISGROUPMAIN.TW
NOVARIS-GROUPORG.CC
VITAL-GROUPCO.CC
VITAL-GROUPCO.TW
VITAL-GROUPINC.TW
PERSEUS-GROUPFINE.TW
PERSEUS-GROUPINC.TW
PERSEUSGROUPLLC.CC

Consider going through my previous research into one of the most popular 'risk-forwarding' tactic used by cybercriminals, namely, money mule recruitment.

Related posts on money mule recruitment:
Keeping Money Mule Recruiters on a Short Leash - Part Eleven
Keeping Money Mule Recruiters on a Short Leash - Part Ten
Keeping Money Mule Recruiters on a Short Leash - Part Nine
Keeping Money Mule Recruiters on a Short Leash - Part Eight - Historical OSINT
Keeping Money Mule Recruiters on a Short Leash - Part Seven
Keeping Money Mule Recruiters on a Short Leash - Part Six
Keeping Money Mule Recruiters on a Short Leash - Part Five
The DNS Infrastructure of the Money Mule Recruitment Ecosystem
Keeping Money Mule Recruiters on a Short Leash - Part Four
Money Mule Recruitment Campaign Serving Client-Side Exploits
Keeping Money Mule Recruiters on a Short Leash - Part Three
Money Mule Recruiters on Yahoo!'s Web Hosting
Dissecting an Ongoing Money Mule Recruitment Campaign
Keeping Money Mule Recruiters on a Short Leash - Part Two
Keeping Reshipping Mule Recruiters on a Short Leash
Keeping Money Mule Recruiters on a Short Leash
Standardizing the Money Mule Recruitment Process
Inside a Money Laundering Group's Spamming Operations
Money Mule Recruiters use ASProx's Fast Fluxing Services
Money Mules Syndicate Actively Recruiting Since 2002

This post has been reproduced from Dancho Danchev's blog.