Developers of Zeus Panda virus present new distribution strategy

Zeus Panda virus used SEO to attack users

Security researchers warn about new and clever Zeus Panda virus distribution campaign. Developers of the malicious program used Search Engine Optimization (SEO) for poisoning specific financial and banking-related keywords. In order to succeed, crooks compromised business websites first to rank high in Google search results.

Zeus virus is known since 2017. However, for almost a decade new variants of the malicious program are emerging and trying to steal personal information about users. The Zeus Panda, or Panda Banker, virus has been detected in 2016. However, researchers from Cisco’s Talos reported about new distribution campaign at the beginning of November.

According to the report, criminals used a combination of SEO, compromised legit websites and malicious Word macro commands to install data-stealing malware on victim’s computer. Security researchers tell that malware targeted users of  these banks:

  • Nordea Sweden,
  • the State Bank of India,
  • India’s Bank of Barodia and Axis Bank,
  • the Commonwealth Bank of Australia,
  • Saudi Arabia’s Al Rajhi Bank.

Previously, Panda trojan targeted Australian and British banks. However, the interesting fact is, that malware uses geo-filtering. Once it gets inside the device, it checks computer’s language settings. The virus does not launch its activities if the default language is Russian, Ukrainian, Belarusian or Kazakh.

Criminals sophisticated and well-prepared attack

First of all, the attackers compromised legit business websites in order to rank higher in Google search. Then attackers poisoned specific keywords that were supposed to redirect to corrupted sites. According to the research, criminals managed to show their malicious results several times in Google results page when users entered these keywords:

  • “nordea sweden bank account number”
  • “how many digits in karur vysya bank account number”
  • “free online books for bank clerk exam”
  • “al rajhi bank working hours during ramadan”
  • “how to cancel a cheque commonwealth bank”
  • “free online books for bank clerk exam”
  • “salary slip format in excel with formula free download”
  • “bank of baroda account balance check”
  • “axis bank mobile banking download link”
  • “bank guarantee format mt760”
  • “sbi bank recurring deposit form”

The compromised websites included a malicious JavaScript code to initiate redirects until a macro-enabled document is installed on the system. Once opened, the document asks to enable macros to view the content. Indeed, clicking “Enable Content” button leads to the installation of Zeus Panda virus.

Developers of Panda Trojan used traditional malware distribution methods before

Since the appearance of Zeus Panda malware, authors tried several distribution methods until they came up with the idea to rely on SEO. They spread the trojan via malicious spam emails and three exploit kits – Angler, Nuclear and, Neutrino.

However, the malspam campaigns also included Word document that downloaded malware executable on the system. Other campaigns exploited CVE-2014-1761 and CVE-2012-0158 vulnerabilities to attack media and manufacturing corporations.

Bad Rabbit ransomware: tips to avoid the latest version of Petya

New variant of Petya emerged – Bad Rabbit ransomware virus

On the 24th of October, the new version of Petya ransomware was reported to attack Russian and Ukrainian organizations. Petya is known for attacking Ukraine companies and public sector. However, this time the recently discovered Bad Rabbit ransomware hit harder Russia.

According to the latest information, Bad Rabbit virus attacked Kiev Metro and Odessa International Airport. Even though there’s still not a lot of information about the damaged caused to these infrastructure’s systems, the attack is warning sign to all organizations and companies to make sure that their systems and networks are protected.

Additionally, reminding employees security tips is also recommended. The current version of Petya virus spreads as fake Adobe Flash update. Thus, inexperienced users can be easily tricked into downloading a malicious file and causing serious problems to the whole computer network.

However, security researchers did not take long to find a vaccine to prevent ransomware infiltration. Though, basic security tips are also recommended to follow.

Bad Rabbit malware masquerades as Flash update

Drive-by downloads are one of the distribution methods used for spreading Bad Rabbit ransomware virus. The fake Flash update is injected into compromised websites. If users end up on a malicious site, they receive a pop up asking to install the latest update. Once they hit “Install” button, the malicious executable is dropped to the Win32/Filecoder.D folder. Then the install_flash_player.exe file is executed, malware starts data encryption procedure.

However, malware might also exploit a vulnerability in Windows Server Message Block (SMB). At first, it was thought that malware uses EthernalBlue vulnerability. However, latest analysis data says that it’s not true. Malware just scans the internal network and looks for open SMB shares. If it finds, it might affect the whole network.

Protecting computers and networks from ransomware

Bad Rabbit ransomware might cause extreme damage to your company or paralyze important city infrastructures, such as public transportation. However, home computer users should be aware of security tips too.

After the infiltration, malware immediately locks files with a combination of RSA-2048 and AES-128-CBC encryption ciphers and makes them unable to open due to .encrypted file extension. In order to recover files, victims are asked to pay 0.05 Bitcoin. However, the size of the ransom might increase.

Security researchers discovered a vaccine that helps to protect devices from the latest version of the Petya ransomware:

  1. Create infpub.dat and cscc.dat files in c:\windows directory by running cmd.exe as an administrator and entering these commands:
    echo “” > c:\windows\cscc.dat&&echo “” > c:\windows\infpub.dat
  2. Right-click on each of the newly created files and select Properties.
  3. 
Access Security tab in the appeared Properties window.
  4. Click Advanced option.
  5. In the newly appeared window click “Change Permissions…” button.
  6. Uncheck “Include inheritable permissions from this object’s parents” box (Windows 10 users have to choose “disable inheritance button” and then select “Remove all inherited permissions from this object”).
  7. You will receive a Windows Security pop up. Click Remove button.

Additionally, security experts do not recommend paying the ransom and advise to take precautions in order to avoid losing important data loss:

  • Enable automatic Adobe Flash Player updates. In this way, you or your employees will not be tricked into installing bogus update from the pop-up window.
  • Patch the Windows SMB protocol. Also, make sure that your operating system has all necessary security fixes. Install them as soon as they are offered by Microsoft.
  • Install available software updates. Enabling automatic software updates help to avoid misleading alerts. However, if you prefer monitoring updates, you should be careful and do not forget to install them regularly.
  • Do not open suspicious email attachments. Often ransomware-type viruses spread via malicious spam emails that include an infected attachment. Before opening any attached safely looking files, please check the information about the sender and provided an issue to make sure that it’s actually safe to open.
  • Backup data and update it regularly. Having extra copies of the most important files reduces the damage in case of ransomware attack.
  • Strengthen computer’s protection by installing reputable antivirus.

Cybercrime trends Fall 2017: what cyber threats can you meet online?

Be aware of ransomware: your files are still in danger

Recently, Europol announced that ransomware is the most powerful cyber threat among all. Thus, this autumn user should be prepared for data-encrypting virus attacks. One of these threats is a new version of Locky; and we are not talking about Lukitus and Ykcol variants.

In October 2017, researchers discovered Asasin – a new example of Locky that spreads via corrupted email attachments. If it finds the way into the computer, there’s no way to get back your files.

The BTCWare family also continues to grow up. At the beginning of October, BTCWare PayDay ransomware version has been noticed spreading and asking to pay the ransom. Thus, it’s time to backup to avoid possible damage.

Facebook scammers allure victims with free iPhone X

Virtual life on the biggest social network is not simple and calm. The new wave of Facebook virus spread a scam aiming at Apple fans and those who are in desperate need to get the latest iPhone model for free.

Numerous fake pages were created on Facebook and Instagram to attract users to participate in iPhone’s giveaway. Undoubtedly, no one is going to give free Apple phones. The purpose of this scam is to collect a bunch of sensitive information about users. In order to participate in such contest, people are asked to verify their Facebook accounts, enter the full name or contact details.

Scam posts might also redirect to suspicious pages and shows numerous ads. Therefore, naive users can end up on a malicious website until he or she ends up on a phishing site. Thus, this autumn you should not forget that too-good-to-be-true offers are always created by criminals.

Malvertising attacks become bigger and more sophisticated

It seems that malvertising became a new sweet spot for cyber criminals. This autumn crooks launched two massive campaigns to spread malware-laden ads. At the beginning of October, the legit Taboola advertising platform was hacked.

Malicious Taboola ads were noticed on msn.com website. They redirected to a tech support scam website that warned about “harmful virus” and asked to call a toll-free phone number to Microsoft technicians. Indeed, there’s nothing unique about this scam example.

Later KovCoreG group showed that they are capable of hacking another legit ad-services. This hackers team aimed at one of the most popular and most visited websites – Pornhub. However, this time criminals used a sophisticated attack which targeted users by their location and used browser.

People from the US, Canada, the UK and Australia who visited this porn site using Chrome or Firefox were asked to install a critical update. Meanwhile, Microsoft Edge and Internet Explorer users were tricked by fake Adobe Flash Player update. In this way, cyber criminals tricked millions of users to install Kovter click fraud adware. Thus, being careful with ads this fall is more than important.

Ominuous update: Locky now encrypts data as Yckol virus

Locky remains to be a major issue in the cyber space

Perhaps Locky developers ran out of crafty ideas as they ceased making up intriguing names for their malware. After Diablo6 and Lukitus versions were released, the crooks launched a supposedly new version with a brand new name – Ykcol – which is Locky backward.

Any new features?

The latest version does not manifest any exceptional prowess. Besides the alternations in the name, the source code does not seem to have been changed drastically. Nonetheless, there are slight amendments in the distribution campaign.

The menace continues relying on the Necurs botnet which delivers thousands of spam emails worldwide. Since the introduction of Diablo6 and Lukitus extensions, a change in the employed folder type was spotted as well.

Earlier versions of ransomware tended to hide in a .rar folder, but latest editions, including Ykcol, are placed in .7z folder. It contains a VBS script which activates the execution of the file-encrypting threat.

Locky developers retained the habit of disguising the malware in invoice emails. Previous editions were delivered along with a brief message “Files attached. Thanks”. Ykcol tends to fish for gullible users with “Could you please let me know the status of the attached invoice? I appreciate your help!” messages. An alternative sample of the menace tries to persuade potential victims to launch the virus by disguising under the name of Herbalife Nutrition company, which is the nutrition and weight management company located in the US.

From invoices to fake verification emails

While the attention is concentrated on Ykcol ransomware, Lukitus and Diablo6 crypto-viruses should not be ignored as well. Recent analysis reveals that the racketeers disguise the malware under fake Dropbox account verification emails.

In addition, company employees should be especially vigilant about Locky. There have been versions detected which include counterfeited scanned .png images. They are called as scanned printer images.

The problem is that Locky targets company servers. Consequently, it can easily foist such message. Unsuspecting users, thinking that the email was sent by a colleague, might open the corrupted version only to find out Ykcol or Lukitus encrypting their files afterward.

However, though the developers of this menace seem to use conservatives techniques, Locky still remains undecryptable.
Considering prevention means, attentiveness and cyber security are the key factors in warding off Locky:

  • install system updates once they are published
  • update security tools
  • use a couple of different type anti-malware apps
  • double-check the sender of a received suspicious email
Cerber and Locky viruses strike again

Hacking in summer time – Locky and Cerber developers start another distribution campaign

Cerber or Locky – ever-evolving and ever-lasting cyber issues

In case you started wondering whether, by any chance, the notorious two ransomware giants got finally terminated, we are sorry to disappoint you. It seems that the developers of these two threats have wisely spent the summer time: improved viruses target netizens again. What’s new and what should you beware of?

Cerber now sniffs for personal data

Corresponding to its original name – the mythical creature Cerber – the developers decided to add data-stealing features. Now the latest version of the virus, which is distributed as CRBR Encryptor, is able to capture browser passwords and bitcoin wallet-related information.
Besides looking for Chrome, Internet Explorer, Firefox and other browser passcodes, the infection also attempts to steal Bitcoin Core wallet, Multibit and Electrum wallet information.

IT specialists suspect that the source code enabling the mentioned function might belong to another project. Though this new update certainly makes the malware even more menacing, data stealing ransomware is not a novelty. Last year some CryptXXX variants were spotted in engaging in data stealing activity as well.

Locky strikes again in a new disguise

While the title of “Locky ransomware” had been regularly flickering in the media headlines last year, its authors has not abandoned this project. In fact, the time periods between each version imply that the crooks have been working on the new more destructive techniques. Consequently, this summer they decided to drop the habit of naming their virus versions after the names of Egyptian and Scandinavian deities and return to the European mythology.

IT specialists have caught its new version – Diablo6 ransomware – spreading via a new malicious spam campaign. However, observing the tendency, Locky developers have not mastered any extraordinary new technique. As in previous cases, they test targeted users’ curiosity. The compromised email might be sent from an unknown sender with a brief message content: “Files attached. Thanks

Opening the E [date] (random_numer).docx file will executes VBS downloader script which then downloads the main payload of the virus. During the encryption process, the malware will append ridiculously long [first_8_hexadecimal_chars_of_id]-[next_4_hexadecimal_chars_of_id]-[next_4_hexadecimal_chars_of_id]-[4_hexadecimal_chars]-[12_hexadecimal_chars].diablo6 file extension. The current version is relatively modest—it only asks for .49 bitcoin amounting $1.600.

Unfortunately, neither of the ransomware threats are decryptable at the moment. While cyber security specialists continue working on the countermeasures, the virtual community should arm up with awareness and knowledge. Except Cerber, which indeed keeps evolving at the alarming rate, Locky developers seem to rely on the same spam campaigns. If you manage to bridle your curiosity and treat incoming spam emails with cautiousness, you will lower the risk of encountering file-encrypting threats.

AdsKeeper and Stack Player continue bombarding web browsers with ads

Researchers noticed an increased activity of adware programs

Recently, cyber security experts noticed an increased activity in AdsKeeper and Stack Player distribution. These two ad-supported programs are well-known for a while. They have already made browsing the web complicated for hundreds of thousands of computer users.

These programs are known for:

  • being capable of entering the system in software bundles;
  • altering browser’s settings;
  • using “virtual layer” to display third-party ads;
  • delivering an excessive amount of ads;
  • delivering misleading and malicious ads;
  • redirecting to high-risk websites;
  • tracking information about users.

All these negative features disturb browsing the web and make the system vulnerable. For this reason, infected computers become easily accessible to other cyber threats and malware.

We want to point out that you should be careful when installing freeware or shareware. This two adware are widely spreading with PDF converters, video players, and other free programs. Thus, in order to avoid it, you should:

  • choose reliable sources for software installation;
  • use Advanced/Custom installation settings;
  • do not rush to click “Next” button;
  • unmark all third-party entries offered to download together with the primary program.

The major issues caused by AdsKeeper adware

Nevertheless, AdsKeeper is a legitimate advertising program; it might pose a danger to computer users. Some of the ads delivered by this ad-supported application might redirect to potentially dangerous websites.

The problems begin then adware enters the system silently. It might alter targeted browser’s settings in order to display third-party commercial content on various sites. The PUP might deliver ads even on well-known sites. Thus, you can be easily tricked that offer is reliable and safe to click.

However, research has shown that some of the AdsKeeper ads have nothing in common with safety and credibility. Cybercriminals and scammers often take advantage of this advertising platform in order to spread malicious ads.

Within one click, you might end up on tech support scam or phishing website. Crooks might convince you into installing bogus software or revealing personal information. Thus, this adware might be responsible for helping criminals to reach innocent computer users.

It doesn’t matter that it’s not an intended purpose of the adware program. You should take care of your privacy and computer by performing AdsKeeper removal.

The main characteristics of Stack Player virus

Stack Player is advertised as useful video streaming tool that allows browsing through the huge library of video content and watching it straight through the desktop. Indeed, this free application might seem interesting for those who spend hours watching videos.

However, it’s hard to talk about this program’s functionality because it’s impossible to keep it for a long on the computer. After the installation, it instantly starts tracking information about users and delivers suspicious ads on each visited website.

One of the main problems is that Stack Player ads redirect to high-risk websites or promote bogus antivirus, PC optimization software or suspicious browser extensions. Misleading security alerts and offers to install crucial updates might hide malware as well.

Thus, we want to remind that you should stay away from this program and be careful with installation of freeware or shareware. This program might enter the system bundled too. However, if you already made a mistake and allowed this program to settle in your PC, we recommend following Stack Player removal instructions and getting rid of adware immediately.

AdNetworkPerformance.com marketing platform comes to life again

AdNetworkPerformance.com ads are looking for new victims

If you have run into the website having a ridiculously long URL domain name starting with www.adnetworkperformance.com/a/display.php, you are likely to see a congratulatory alert. It might come from a supposed Google Rewards Center or most recent one – Facebook Reward Center.

Before you hit the ceiling with joy for supposedly having won an iPhone or another valuable product, let us remind you that it is simply a fake alert. Alternatively, other users may encounter alerts suggesting to update their browsers, Java or Adobe Flash Player.

Advertising intertwines with malvertising

Even though the domain is entitled as Ad Network Performance, it has been one of the oldest spam and adware samples. Originally, such alerts may have simply annoyed you to death, but recent findings suggest that they divert towards a new trend – malvertising.

Due to the popularity of social networks, such as Twitter or Facebook, you might notice the number of supposedly affiliated websites which offer you to reclaim their free giveaways.

A while ago, another spam felony infiltrated Facebook deceiving users with supposedly free flight tickets. It was not only a surprise for netizens but for the very companies which have been mentioned.

Then, users had to fill up a short survey. Then, they would be redirected to an affiliate website which requires entering private information – phone numbers or email address.

AdNetworkPerformance.com functions the same. If you disclose any of such details in one of the affiliated websites, get ready for the stream of ads popping up during browsing sessions or cramming your Spam folder.

Another key problem is that this domain is only the tip of the iceberg. There are multiple others: tradeadexchange.com, venturead.com, totaladperformance.com, liveadexchanger.com, pureadexchange.com, etc.

Old tricks along with new strategies

It is surprising that such adware and malvertising techniques are quite old and there have been numerous articles written on this topic, still a high number of users take the bait. It explains why fraudsters have revived AdNetworkPerformance.com marketing technique.
Besides this well-known strategy, keep in mind that crooks come up with new astounding techniques.

Felons have developed a way how to foist malware for users. They do not need to click on a corrupted link or a file – hovering over it is enough. Despite how elaborate spam techniques might emerge, cautiousness remains the ultimate weapon escaping such felony.

The name of Zeus Trojan is widely used by scammers

Tech support scammers send fake alerts about Zeus infection

Zeus Trojan is one of the oldest banking Trojans that started its career in July 2007. Malware has already affected hundreds of thousands of companies, banks, and governmental institutions. Nevertheless, criminals ended their career in 2011; their followers continued spreading new variants of the Trojan.

Meanwhile, scammers, who lack of imagination or creativity, took the name of the trojan in their illegal projects. The name of the banking Trojan is widely used in various technical support scams.

Undoubtedly, the purpose of such scams is to scare people and make them call to fake tech support line where “certified technicians” are willing to help to clean a virus from the computer.

Examples of tech support scams

Getting infecting with Zeus is a terrifying experience. Scammers are aware of human psychology and fear of catching computer infections. Thus, the name of the dangerous banking Trojan should help to commit another cyber crime.

Such scams usually deliver messages in the browser’s window, such as “Windows Defender Alert: Zeus Virus”, “Windows Detected ZEUS Virus” or “You Have A ZEUS Virus.” All these fake alerts state the same – your computer is infected; call the provided number.

However, none of these messages are true. Only antivirus program installed on your PC can inform about malware attack in a program notification window.

All other alerts that appear on the browser are fake, and most probably, created by cyber criminals who are willing to take control over your computer, obtain your personal information or sell a useless software.

Signs of the real Zeus attack

If you ever find yourself on the website that informs about dangerous banking Trojan residing on the system, you should not take any spontaneous actions. Especially, do not grab your phone to call the provided number.

As we have already mentioned, online security alerts are fake. What is more, usually crooks introduce themselves as Microsoft technicians. However, Microsoft does not have a phone support line. Thus, it’s the main sign that you have been scammed.

The real Zeus malware attack is followed by slow computer’s performance, disabled security software, unknown system errors, increased amount of aggressive online ads, and of course, suspicious financial transactions or even empty bank account.

We want to remind that once you suspect that your computer is infected, you should run a full system scan with an updated security tool immediately.

Good news for victims of Jaff ransomware: free decryptor is already available

As Virus Activity blog reports, there’s no need to worry about Jaff ransomware anymore. This recently emerged cyber threat is already decryptable.

This ransomware was noticed spreading via Necrus botnet at the end of spring 2017. Crooks send numerous malicious spam emails that included obfuscated PDF attachment. These files were renamed as copies, scans, invoice and similarly. Apparently, too many users believe that these documents cannot pose harm to their computer.

Unfortunately, these naïve assumptions were wrong. A safely-looking PDF file was actually a DOCM document. This macro-enabled document asked to click “Enable Content” button and clicking it lead to the installation of ransomware.

During its quite short lifetime, malware was updated several times. Different versions of the virus marked encrypted files with .jaff, .wlu and .sVn extensions that made them impossible to open.

However, malware researcher from Kaspersky Labs found the flaw in ransomware’s code. This discovery helped to create a decryption software that can unlock encrypted files for free. Meanwhile, developers of virus offered to use their questionable decryptor for 1.82-2 Bitcoins.

Victims were never encouraged to have business with cyber criminals. However, desperate need for files might have lead thousands of people to pay the ransom. Fortunately, obtaining a decryption key from hackers is no longer an option. Free and secure decryption software can be downloaded from here.

Nevertheless, data recovery seems the most important task after ransomware attack; it’s not quite true. Before taking advantage of the newly created decryptor, you have to make sure that Jaff malware is no longer on your computer.

While crypto-malware resides on the system, all attempts to recover your files might fail. The virus might encrypt decrypted files again. It goes without saying that this malicious program running on your computer also makes the system vulnerable and easily accessible to other cyber threats. Thus, first of all, you have to focus on virus removal.

For ransomware elimination, you will need to use a professional malware removal program and run a full system scan. However, this ransomware is designed to prevent from simple deletion from the system. Thus, you may need to take extra steps before running security software. In this case, Jaff removal instructions on 2-spyware will be handy to you.

May 2017: WannaCry causes the most of the headache

Nearly a month has passed since the first reports about WannaCry ransomware started flooding the Internet. And there were definitely some intense few weeks. Home users, businesses and even major organizations such as hospitals or telecommunication services have been losing large quantities of data and money to this parasite. Some had to suspend or limit their daily operations because of the attacks. For now, the initial wave of WCry attacks seems to have ceased, so we can look back on it in a more of structured manner and highlight the things that have been causing the most headache to the online community.

For a large portion of May after the virus showed up, WCry has been peaking rapidly and infecting thousands of devices a day. Reports about new targeted countries would also emerge daily, causing panic across the world. Over the span of a month, the malware managed to infect over 400,000 machines, making the history as the biggest ransomware attack to this day. The virus would probably have not made it this far if not for the ETERNALBLUE exploit which the hacker group called Shadow Brokers have leaked from the NSA’s secret servers earlier in April. The exploit specifically targeted MS17-010 vulnerability found Windows operating systems. In particular, 98 percent of the affected machines were outdated Windows 7 versions which no longer receive security patches from Microsoft. This security hole is still a major threat for the users who have are using an expired software or have not updated their Windows 10 to the latest version. Undoubtedly, ransomware will thrive as long as the criminals will be able to take advantage of such vulnerabilities.

Despite the fact that security experts managed to come up with a killswitch and decryptor which partially immobilized WannaCry, the virus success has spiked a new wave of interest in ransomware development. Experts say, that spin-off versions such as XData or WannaCry 2.0 are just a beginning and the grim legacy this nasty cyber infection will continue in the future. Thus, it is important to brace ourselves for the potential attacks, protect our devices with professional security software, regularly look for system updated and keep backups.