Antivirus Eviasion – msiexec obfuscation

A thread on the SANS ISC InfoSec forum described yet another infection case – and one detected by only a few antivirus programs! This is a very good result from the perspective of the attacker. This was especially so in that, according to VirusTotal, the software that...

Mexican botnet on the rise

The Trend Micro blog posted about a new botnet similar to Mirai. How does a botnet work? Its activity was first observed in Mexico. The botnet scanned domestic routers using the GPON (Gigabit Passive Optical Network) standard, which can be accessed via default...

SYLK files as a malware distribution method

The SANS ISC InfoSec forum described the interesting use of SYLK files (with the .slk extension). This is one of the methods to bypass detection by antivirus solutions. What is a SYLK file? A Symbolik LinK or SYLK (.slk extension) file is a Microsoft format used to...

Data stolen from TEMPEST-class computers

Israeli researchers have found a way to extract data from isolated computers – and it is not about “ordinary” computers operating within a separate network, but special-purpose TEMPEST (Transient Electromagnetic Pulse Emanation Standard) machines. What is the...

Drupal vulnerability – updating the CMS of your website

A critical vulnerability is not the end of the world if the issue is addressed properly. This is what the security team at Drupal – a Content Management System (CMS) did. 2 weeks ago, they identified a serious Drupalgeddon2 security vulnerability. However, before this...