The Kings in Your Castle Pt. #1
In an upcoming series of articles on the intricacies of targeted attacks, G DATA’s Marion Marschalek and Raphael Vinot of the Computer Incident Response Center Luxembourg (CIRCL) will shine a light on the internal workings of modern APTs and present their findings during the Troopers Conference in…
World of Warcraft: one simple line of code can cost you dearly
A few days ago, a new type of gold/item scam made the rounds. Usually scamming in MMORPGs is done using social engineering techniques, e.g. an attacker sells a fake item code for alleged in-game items like mounts to a potential victim for in-game currency. But this most recent kind of attack does…
“HummingBad“ – Money-making Malware, Made in Asia
During the past few days and weeks reports surfaced according to which a new type of malware has infected millions of smartphones and tablet PCs worldwide. The malware in question is highly lucrative for its makers – each month they can rake in up to 300.000 Euros in revenue. The makers of this…
Panama Papers: the result of neglected IT security
The financial, legal and political world have been turned upside down by the Panama Papers. But how on earth was it possible to steal 2.6 terabytes of data from Mossack Fonseca?
G DATA Exploit Protection effectively prevents attacks by infected Magento shops
Thousands of online shops running an outdated version of the Magento eCommerce platform have been infected with malware since 18 October 2015, according to a report by security firm Sucuri (https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html). The infected shops distribute…
IoT: The Internet of Things... ehm... Trouble
It is 20 years ago that I first included a slide in my presentation about sending spam via a refrigerator. At the time, most people found that ridiculous. Yet last year, it became a reality. Refrigerators have now become 'smart’ and can do a whole lot more than just keep things cool. The Internet…
Casper: the newest member of the cartoon malware family
Casper is considered to be EvilBunny’s and Babar’s successor, believed to be originating from the same group of programmers – possibly connected to a French intelligence agency. Two very interesting changes the malware has undergone: it now has a modular structure which allows the attackers to…
The power of trust: “Superfish” case turns into a worst case scenario
The case of the “Superfish” adware has caused quite a sensation through its association with computer technology company Lenovo. However, the following report shows that “Superfish” is just the tip of the iceberg. It explains the implications of and possibilities for misuse. By way of an example,…
Babar: espionage software finally found and put under the microscope
Almost a year after Operation SNOWGLOBE was publicly mentioned for the first time by the famous French newspaper Le Monde, security experts have now laid hands on malware samples that match the descriptions made by the Communication Security Establishment Canada (CSEC). The following analysis is the…
Analysis of Project Cobra
Project Cobra and the Carbon System were mentioned by Kaspersky in the article called “The Epic Turla Operation” . This malware is used by the same actors as Uroburos (aka Snake/Turla) and Agent.BTZ. We estimate that Carbon System was developed after Agent.BTZ and before Uroburos. The Carbon System…
Karsten Hahn
Principal Malware Researcher
Tim Berghoff
Security Evangelist
