Trojan

Updated on 2023-01-11 SF BART ransomware The San Francisco Bay Area Rapid Transit (BART) is investigating an intrusion of its IT network after the Vice Society ransomware gang claimed to have compromised the agency via a blog post on their dark web leak site. The agency’s spokesperson told The Record that “no BART services or …

Updated on 2022-12-22 Trustwave has looked at recent distribution campaigns spreading the Ekipa remote access trojan. Read more: Malicious Macros Adapt to Use Microsoft Publisher to Push Ekipa RAT Overview The same CloudSEK team also published a report this week on Ekipa, a remote access trojan sold on underground cybercrime forums for $3,000. According to …

Updated on 2022-12-21: Godfather Android banking trojan Group-IB researchers have an analysis of Godfather, an Android banking trojan built on top of the old Anubis trojan. Godfather currently contains modules to target the customers of 215 banks, 94 crypto wallets, and 110 crypto exchange platforms. The trojan has been active since June 2021. Read more: …

Updated on 2022-12-01 Schoolyard Bully Mobile security firm Zimperium said it discovered a new Android trojan named Schoolyard Bully that has been active since 2018. Disguised as educational apps in both the Google Play Store and other third-party app stores, this malware has been downloaded more than 300,000 times across 71 countries. Zimperium says the …

Updated on 2022-11-22 Yoroi founder and CEO Marco Ramilli published a report on recent developments in the operations of Hagga, a threat actor known for distributing infostealer trojans. Recent changes include the adoption of Fsociety Tools, an open-source penetration testing framework. Read more: Is Hagga Threat Actor (ab)using FSociety framework ? An Analysis of Infrastructure …

Updated on 2022-11-22 Antivirus maker Bitdefender said it identified four Android apps on the official Play Store acting as downloaders for the SharkBot banking trojan. The apps were file managers but also contained malicious code to help deploy malware on a user’s device after their Play Store installation. Read more: Android SharkBot Droppers on Google …

Updated on 2022-11-02 A set of four malicious apps, developed by the Mobile apps Group, was found propagating the HiddenAds trojan. The apps have been downloaded over a million times from the Google Play Store. Read more: Malware on the Google Play store leads to harmful phishing sites Updated on 2022-11-01: New malware from the …

Updated on 2022-10-31 QiAnXin researchers have published a report on a recent campaign carried out by the APT-Q-36 threat actor, also known as PatchWork or White Elephant. The final payload in this attack was a malware strain known as the BADNEWS trojan. Read more: APT-Q-36：南亚摩诃草组织近期武器库迭代更新分析 Updated on 2022-10-28: Patchwork’s Operation Herbminister Chinese security firm Knowing …

Updated on 2022-10-28: ERMAC v2 QuoIntelligence published an in-depth analysis of ERMAC v2, an Android banking trojan that was first spotted last year and which got updated to v2 earlier this year in May. Read more: ERMAC 2.0 Evades MFA to Steal Banking Credentials of Over 400 Android Apps ERMAC – another Cerberus reborn A …