Malware

Ransomware’s Brutal ‘Second Wave’

Winter is coming and ransomware is well underway with a brutal second wave. And while some may call this just…

1 month ago

Code Comments Reveal SCP-173 Malware

We sometimes find malware code injections that contain strange code comments, which are normally used by programmers to annotate a…

1 month ago

Agent Tesla: A Day in a Life of IR

Introduction The Agent Tesla infostealer has been around since 2014. During the last two to three years, it's also had…

2 months ago

ALFA TEaM Shell ~ v4.1-Tesla: A Feature Update Analysis

We’ve seen a wider variety of PHP web shells being used by attackers this year —  including a number of…

2 months ago

Legacy Mauthtoken Malware Continues to Redirect Mobile Users

During malware analysis, we regularly find variations of this injected script on various compromised websites: . The variable “_0x446d” assigns…

2 months ago

CSS-JS Steganography in Fake Flash Player Update Malware

This summer, MalwareBytes researcher Jérôme Segura wrote an article about how criminals use image files (.ico) to hide JavaScript credit…

2 months ago

Honorably Serving Our Veterans Wherever the Mission Goes

The VA Has an Opportunity to Rethink Its Cybersecurity Posture in the New Normal with Cloud Web Isolation. Covid-19 and…

2 months ago

Reflected XSS in WordPress v5.5.1 and Lower

WordPress released version 5.5.2 yesterday, which fixed a reflected XSS vulnerability we reported earlier this year. The root cause of…

2 months ago

Egregor: Sekhmet’s Cousin

The year 2020 will be remembered none too fondly for several reasons. For much of the world, the global pandemic…

2 months ago

Ransomware’s Next Target: Backup Data

Ransomware is a big business today and getting bigger all the time. It is so profitable that organized crime and…

2 months ago