The current threat landscape is often driven by web-based malware and exploit kits that are regularly updated with newly found vulnerabilities. Recently, we received an interesting malware binary–a JAR package that opens a back door for an attacker to execute commands and acts as a bot after infection. This archive does not exploit any Java […]
As I wrote in parts one and two of this series of blogs, Java.Cogyeka uses an autorun.inf file to propagate and download an additional module. I was able to get the downloaded module, based on a Java application, even though it took over a week because of the difficulty in establishing a connection with the […]
While researching PlugX propagation with the use of Java exploits we stumbled upon one compromised site that hosted and pushed a malicious Java applet exploiting the CVE 2013-0422 vulnerability. The very malicious Java application was detected heuristically with generic verdict for that vulnerability and it would have been hardly possible to spot that particular site […]
Latest Comments