Specialists from the Russian anti-virus company Doctor Web have studied one of the most widespread threats in April 2013, the Trojan Trojan.Mods.1, formerly known as Trojan.Redirect.140. According to statistics compiled by the curing utility Dr.Web CureIt!, the number of infections with this Trojan represent 3.07% of the total number of detected threats. A summary of […]
Since the publication of our report, our colleagues from Seculert have discovered and posted a blog about the usage of another delivery vector in the Red October attacks. In addition to Office documents (CVE-2009-3129, CVE-2010-3333, CVE-2012-0158), it appears that the attackers also infiltrated victim network(s) via Java exploitation (MD5: 35f1572eb7759cb7a66ca459c093e8a1 – ‘NewsFinder.jar’), known as the […]
Following the Dreamhost hack, that was revealed this week, many websites hosted by the company have been hijacked to redirect users to a Russian scam page. I’ve identified hundreds of websites hosted by DreamHost that contained a PHP page redirecting to hxxp://www.otvetvam.com/. Here are a few examples: http://www.lciva.com/wp-content/plugins/extended-comment-options/gyrewnv.php http://honorboundphoto.net/photos/10007-mankato_habitat_for_humanity_golf_tournament/agtruje.php http://ryanmasters.ca/wp-content/gallery/our-kingdom/thumbs/tyiueg.php http://treatmentofpanicattacks.com/wp-content/cache/supercache/www.treatmentofpanicattacks.com/category/anxiety-support/polzin.php http://r4theband.co.uk/content/wp-content/themes/agregado/includes/cache/gyrewnv.php http://dedehaluk.com/cache/hakkinda/fgjke.php http://www.agustindondo.co.uk/yellowbrick/wp-content/files_flutter/modules/fgjke.php http://dcstavclub.org/wp-content/themes/newzen_2.0_build_105/images/fgndnju.php […]
Latest Comments