Evolution of sophisticated spyware: from Agent.BTZ to ComRAT
In November 2014, the experts of the G DATA SecurityLabs published an article about ComRAT, the Agent.BTZ successor. We explained that this case is linked to the Uroburos rootkit. We assume that the actor behind these campaigns uses several different malware strains in order to compromise the…
Regin, an old but sophisticated cyber espionage toolkit platform
Regin is one of the latest cyber espionage toolkits targeting a range or organizations, companies and individuals around the world. This malware is very sophisticated and it can mentioned in the same breath with other cyberespionage campaigns like Duqu, Stuxnet, Flame, Uroburos (aka Snake/Turla).…
UPDATE: The tool „Detekt“: what you should know about it
As reported, the recently launched tool “Detekt” is a tool to detect nation-state spyware by performing in-memory scans with the help of static Yara rules. G DATA appreciates the approach to raise awareness against spyware, but looking at the technical realization of the tool, we have to say that it…
The tool „Detekt“: what you should know about it
Amnesty International, Digitale Gesellschaft, Electronic Frontier Foundation and Privacy International jointly launched a tool named "Detekt". Primarily, they wish to raise awareness about spying actions against computer users and especially against activists and journalists. The tool is designed…
IT Security, Foosball and Charity: VB 2014 had it all
The VB International conference is a worldwide institution when it comes to IT-Security and its 24th edition held some remarkable highlights. Technical and corporate audiences were able to follow high-class talks and presentations about threats and dangers the industry faces, possible solutions and…
The Uroburos case: new sophisticated RAT identified
In February 2014, the experts of the G DATA SecurityLabs published an analysis of Uroburos, the rootkit with Russian roots. We explained that a link exists between Uroburos and the Agent.BTZ malware, which was responsible for "the most significant breach of U.S. military computers ever." [1] Nine…
COM Object hijacking: the discreet way of persistence
G DATA SecurityLabs experts discovered a new Remote Administration Tool, which we dubbed COMpfun. This RAT supports 32-bit and 64-bit Windows versions, up to the Windows 8 operating system. The features are rather common for today’s espionage tools: file management (download and upload), screenshot…
Cuckoo Sandbox Evasion PoC available
In the beginning of this week we discovered a security flaw in the famous malware analysis framework „Cuckoo Sandbox“. We disclosed this bug to the developers on the 7th of October 2014. Not even three hours later the patch was verified and the updates were supplied by the developers.
G DATA Malware Report July - December 2013
G DATA’s Malware Report H2 2013 includes the most important statistics and information regarding new malware types, websites’ threat potential as well as botnet and banking Trojan activities. Check out the essential facts.
Hotel safes - are they really safe?
This is the beginning of the holidays; a lot of people will travel during the next weeks and may stay in a hotel. The rooms are usually equipped with a safe to store valuables such as money, passports or your laptop. Experts of the G DATA SecurityLabs checked the security level of one safe which is…
Karsten Hahn
Principal Malware Researcher
Tim Berghoff
Security Evangelist
