Creators of SpyEye Virus Sentenced to 24 Years in Prison

In Brief
Two International hackers, Aleksandr Andreevich Panin and Hamza Bendelladj, have been sentenced to a combined 24 years and 6 months in prison for their roles in developing and distributing SpyEye banking trojan, a powerful botnet similar to the infamous ZeuS malware.

Both hackers were charged with stealing hundreds of millions of dollars from banking institutions worldwide.

Enable this New Setting to Secure your Computer from Macro-based Malware

Do you deal with MS Word files on the daily basis?

If yes, then are you aware that even opening a simple doc file could compromise your system?

It is a matter to think that the virus does not directly affect you, but it is you who let the virus carry out the attack by enabling deadly "Macros" to view the doc contents that are generally on eye-catching subjects like bank invoice.


How

How Just Opening an MS Word Doc Can Hijack Every File On Your System

If you receive a mail masquerading as a company's invoice and containing a Microsoft Word file, think twice before clicking on it.



Doing so could cripple your system and could lead to a catastrophic destruction.



Hackers are believed to be carrying out social engineering hoaxes by adopting eye-catching subjects in the spam emails and compromised websites to lure the victims into

Here's How to Decrypt Hydracrypt & Umbrecrypt Ransomware Files

Over the last few years, we have seen several types of Ransomware malware that demand a whopping amount of money from users for the retrieval of their locked, compromised sensitive files.



We have also witnessed the birth of decryption solution for some of the Ransomware like Cryptolocker (partial), Coinvault, Rescue Kit.



One more solution has recently been released for decryption of

Here's the Facebook Hacking Tool that Can Really Hack Accounts, But...

Yes, you heard me right.



A newly discovered Facebook hacking tool actually has the capability to hack Facebook account, but YOURS, and not the one you desire to hack.



How to Hack Facebook account? How to Hack my Girlfriends Facebook account? My boyfriend is cheating on me, How do I hack his Facebook Account?



These are the queries that most of the Internet users search

Someone Hijacks Botnet Network & Replaces Malware with an Antivirus

The Dridex banking trojan that is widely being used by cyber criminals to distribute malware onto users’ machines has now been found distributing a security software.



A portion of the Dridex banking Trojan botnet may have been hacked or compromised by an unknown Whitehat Hacker, who replaced the malicious links with Avira Antivirus installers.



What is Dridex Banking Trojan? How it Works

ALERT: This New Ransomware Steals Passwords Before Encrypting Files

You should be very careful while visiting websites on the Internet because you could be hit by a new upgrade to the World's worst Exploit Kit – Angler, which lets hackers develop and conduct their own drive-by attacks on visitors' computers with relative ease.



Many poorly-secured websites are targeting Windows users with a new "Cocktail" of malware that steals users' passwords before

Duuzer Trojan: A New Backdoor Targeting South Korean Organizations

Security researchers at Symantec have uncovered a new Backdoor Trojan that grants hackers remote access and some control over infected machines.



"Duuzer," as dubbed by the researchers, has been targeting organizations in South Korea and elsewhere in an attempt to steal valuable information.



The Trojan is designed to infect both 32-bit and 64-bit computers running Windows 7, Windows

This Malware Can Delete and Replace Your Entire Chrome Browser with a lookalike

Security researchers have uncovered a new piece of Adware that replaces your entire browser with a dangerous copy of Google Chrome, in a way that you will not notice any difference while browsing.



The new adware software, dubbed "eFast Browser," works by installing and running itself in place of Google Chrome



The adware does all kinds of malicious activities that we have seen quite

Cisco Takes Down Ransomware Operation Generating $30 Million in Revenue For Hackers

This will blow the minds of every single cyber criminal group out there – Researchers have discovered a group of hackers that is making an estimated $30 Million a year from their online criminal operation.



Yes, $30 MILLLLLLION annually.



Researchers from cyber security firm Cisco announced that they discovered a large ransomware campaign connected to the Angler Exploit Kit, one of the

New Botnet Hunts for Linux — Launching 20 DDoS Attacks/Day at 150Gbps

A network of compromised Linux servers has grown so powerful that it can blow large websites off the Internet by launching crippling Distributed Denial-of-service (DDoS) attacks of over 150 gigabits per second (Gbps).



The distributed denial-of-service network, dubbed XOR DDoS Botnet, targets over 20 websites per day, according to an advisory published by content delivery firm Akamai

Lenovo Caught Using Rootkit to Secretly Install Unremovable Software

Two years ago Chinese firm Lenovo got banned from supplying equipment for networks of the intelligence and defense services various countries due to hacking and spying concerns.



Earlier this year, Lenovo was caught red-handed for selling laptops pre-installed with Superfish malware.



One of the most popular Chinese computer manufacturers ‘Lenovo’ has been caught once again using a hidden

Hacking Team Spyware preloaded with UEFI BIOS Rootkit to Hide Itself

Last Week someone just hacked the infamous Hacking Team, The Italy-based cyber weapons manufacturer and leaked a huge trove of 400GB internal data, including:


Emails
Hacking tools
Zero-day exploits
Surveillance tools
Source code for Spyware
A spreadsheet listing every government client with date of purchase and amount paid





Hacking Team is known for its advanced and

This 20-year-old Student Has Written 100 Malware Programs in Two Years

Security firm Trend Micro has identified a 20-year-old Brazilian college student responsible for developing and distributing over 100 Banking Trojans selling each for around US$300.
Known online as 'Lordfenix', 'Hacker's Son' and 'Filho de Hacker', the computer science student first began his career by posting in forums, asking for programming help for a Trojan he was developing, researchers said

Creator of Blackshades Malware Jailed 4 Years in New York

A Swedish man who was the mastermind behind the $40 BlackShades Remote Access Tool (RAT) that infected over half a million systems around the world was sentenced to almost five years in a U.S. prison on Tuesday.



Alex Yücel, 25, owned and operated an organization called "BlackShades" that sold a sophisticated and notorious form of software, called RAT, to several thousands of hackers and

Beebone Botnet Taken Down By International Cybercrime Taskforce

U.S. and European law enforcement agencies have shut down a highly sophisticated piece of the botnet that had infected more than 12,000 computers worldwide, allowing hackers to steal victims’ banking information and other sensitive data.



The law enforcement agencies from the United States, United Kingdom and the European Union conducted a joint operation to get rid of the botnet across the

Europol Takes Down RAMNIT Botnet that Infected 3.2 Million Computers

It seems like the world has declared war against the Cyber Criminals. In a recent update, we reported that FBI is offering $3 Million in Reward for the arrest of GameOver Zeus botnet mastermind, and meanwhile British cyber-police has taken down widely-spread RAMNIT botnet.



The National Crime Agency (NCA) in a joint operation with Europol's European Cybercrime Centre (EC3) and law

Windseeker – A Malicious App

A malicious app dubbed Windseeker has been detected by security experts at Lacoon Mobile Security that utilizes a rare injection in hooking techniques to spy on the users. It is one of those dangerous Android apps which have drawn the attention of experts at the Lacoon Mobile security and the main features of the app are its injection and techniques to spy on mobile users. The techniques are very rare in mobile ecosystem wherein Windseeker operated on rooted Android devices enables attackers to probe on popular instant messaging apps in China, WeChat and QQ.

Lacoon noticed Windseeker in third party app marketplace though an attacker would need physical access to the device to get installed and to register the app. In a recent interview with SC Magazine, Avi Bashan, CISO at Lacoon Mobile Security states that the app’s injection and hooking techniques are a focal point of the threat wherein the techniques has two sections.

The first being the injection that occur on the native file which uses ptrace procedure and is also used to inject a second file to target instant messaging app while in the second section, the injected native file loads a java file which enables to monitor the activity of the messaging app through the API hooking.

Threat – Cause for Worry

This discovery is a cause for worry and Bashan explains that these types of treat could be utilized in spying data of any kind of application. In his blog he has also mentioned about the threat that it was `important to understand that this type of threat could be implemented anywhere’. Bashan further states that `hooking over an API code would mean that each time the app calls to the API, instead of going directly to the system, the data is intercepted by the attacker and when it is on the device, it is called “hooking” and when it is over the network it is known as a man-in-the-middle attack which PC malware has been doing it for years. Bashan has also highlighted in his blog post that the hooking techniques does not seem to be a common attack method in the mobile field.

How Does the Windseeker Functions

Initially the Windseeker checks if the device is rooted since it is essential for the app to run and if rooted, it performs the following process:

• Creates a process monitoring thread which is used to identify if IM apps such as WeChat or QQ are active. 
• Request the user to register with its management server through SMS 
• It injects a malicious code which in fact is the hooking process that enables the Windseeker to spy on WeChat and QQ 
• It directs the monitored data back to the threat actor’s controlled server where the details from the IM chat could be viewed conveniently from a web interface.

The target gets the opportunity of viewing the Windseeker app that is installed but will be unaware of its capabilities of monitoring their instant messaging chats. According to Bashan, till now commercial mobile surveillance apps sought an app’s data through a file system or a memory dump and the hooking techniques indicates a new step in the evolution of threat in mobile resembling the way PC based malware evolved all through the years.

Steps to be taken for Protection - 

• Avoid rooting the device since it exposes the device to these kinds of threats. 
• Avoid installing application from unreliable application marketplaces or unknown sources. 
• Ensure to review your list of installed applications frequently to see if there is anything that is unfamiliar.

iOS Trojan –Malicious Software, Chinese Creation

The Lacoon Mobile security researchers’ team have identified one of its first Apple iOS Trojan attacks to oppose communication of pro-democracy Hong Kong activists. Initial investigation indicates that the Trojan has an impressive number of surveillance capabilities.

The malicious software discovered has been dubbed Xsser mRat which uses social engineering to rob valuable data from jail broken devices while the users unknowingly tap on an install link in phishing messages from unknown users.

The malicious software has been created by Chinese hackers wherein it can obtain various range of personal information which could include the iOS address book, call logs, GSM identities, SMS messages, as well as the approximate geographical location which could be determined by the cell tower ID, pictures on devices together with passwords and other authentication data available in the iOS keychains that are used by Apple ID mail accounts and the other services.

The spyware has the capabilities of obtaining additional data in the cloud like the iOS version, MAC address, device version and phone number, IMSI and IMEI. When it is installed on any device, the Trojan automatically runs on rebooting, updating itself dynamically.

Xsser mRat Targets iOS Devices 

According to Lacoon Mobile Security, the so called virus, Xsser mRat, targets the iOS devices related to Android spyware which have been distributed widely in Hong Kong. In a blog post, it is also mention by Lacoon that Xsser mRat is connected with Android spyware infecting mobile users in Hong Kong which seems to be designed in helping to coordinate Occupy Central Hong Kong protesters and then prepare an attack.

Lacoon has also stressed on the importance of a cross platform mobile attack.It is very rare where cross platform attack could target iOS as well as Android devices, which shows that it could be conducted by some large organization or a big state. Considering that the attack has been used against protesters and executed by Chinese speaking attackers indicates its first iOS Trojan which has been linked to Chinese government cyber function.

The Xsser code has been written in Chinese which has led Lacoon to believe that the attack could be from sophisticated Chinese attackers. There is one hitch wherein the iOS user should have a jail broken device and Android should have a third party app download enabled

First Fully Advanced Operational Chinese iOS Trojan

The Xsser mRat is important since it is the first and most fully advanced operational Chinese iOS Trojan which is presently found. It can cross border with ease and is probably operated by a Chinese entity to spy on foreign companies, individuals or an entire government.

It infects the users’ devices through WhatsApp depending on their geographical proximity to the site of protests and as per Lacoon, Xsser had send out it first message to the user which states `Check out this Android app designed by Code4HK, group of activist coders, for the coordination of Occupy Central’.

When the download link is clicked by the user, they download an apk file unknowingly which presents them with a list of permission that needs to be approved and finally the user is lead to agree to application updates which on doing so, the application gets updated and activates the hidden features of the mRat

Advanced iOS Trojan targeting the Hong Kong protesters

Cyber researchers are clamming to discover the first iOS Trojan, which attacks on the mob of Hong Kong protesters to affect their communications. 

An iOS Trojan known as Xsser mRat is similar in function as an Android virus, and discovered by cyber security researchers, who all believe that this iOS virus is targeting the pro-democracy protesters of Hong Kong. It is computer virus, which spies the operating system of on Apple's such as; iPhone and iPad. According to Lacoon Mobile Security, Xsser mRat is absolutely similar to the spyware of Android, which has initially infected the infected mobile users in Hong Kong. Android spyware was designed to coordinates the protesters of Hong Kong, but soon after infection it launches an attack.

Significance of a cross-platform mobile attack was reported by Lacoon. This cross-platform attack targeted the both Android and as well as iOS and it indicates that it may be conducted by nation state or a very large organization. The fact behind the attack was to use it against the protesters of Hong Kong and it was executed by Chinese-speaking cyber attackers, as first iOS Trojan attack linked to the cyber activity of Chinese government.

The Xsser mRAT is significant as it is first and one of the most advanced, fully operational and functional Chinese iOS Trojan. This malicious software is known as Xsser and is well-capable to steal the text messages, call details, photos, passwords, and other data from Apple devices such as; iPad and iPhone. According to Michael Shaulov, Chief Executive of Lacoon, that Xsser is the most advanced and sophisticated malware and it used to date in any known cyber attack of iOS users.

Programming community Code4HK is working on to support the democracy movement, but in actual it has nothing to do with this phishing expedition. But iPhone and iPad devices are getting infected by single click with mobile Remote Access Trojan (mRAT), when any user clicks on any specific link and soon after that it can easily access the personal data, physical location of phone or device, and can spy on phone calls.

An anonymous attacker was responsible for spreading this Android spyware with the help of platform likes; WhatsApp. Still it’s unclear that how iOS devices get infected by Xsser. According to Michael Shaulov, it is one of the most advanced and interesting developments, as the code used in these programmers are written in Chinese. According to researchers the campaign is high quality and it is coming from somewhere China by sophisticated attackers.

Trojan is the term; used by cyber researchers for virus and it describe malwares, which can enter in the technical device and harm the same. Still Apple has to identify any specific individual, who is suffering from iOS Trojan. It is expected that, it can cross borders easily and it is possible that Chinese-speaking entity is operating the iOS Trojan to spy on foreign companies, individuals, or it can be entire governments or system.