Friday, 28 July 2017
This summer Cerber is on duty. It comes via spear-phishing emails, bypasses antiviruses leveraging polymorphic encryption and API calls obfuscation. The cryptolocker can be easily customized for every target by embedding the JSON-formatted configuration data encrypted with RC4-128 (the decrypted config is on Github for cfd2d6f189b04d42618007fc9c540352). The file encryption scheme 'master RSA-2048 key'-> 'session RSA-880' -> 'file's RC4-128' used by Cerber is not breakable. Cerber scans the IP ranges specified by CIDRs in the config for the C&C server.
Wednesday, 12 July 2017
The undetected PowerShell ransomware was used to attack the popular German car dealer. The attack launched through the spear phishing email looked like a mail delivery notification.
Saturday, 8 July 2017
I'm happy to announce the new Malware Analysis course I've been working for eight years is coming out soon as a part of the EU academic project ENGENSEC financed by the European Commission. In light of the recent nation-state cyber attacks, I'm glad for being related to educating the next generation of cyber security experts being able to counteract cyber attacks at any level.
Wednesday, 5 July 2017
To complement Anton Cherepanov's analysis of Telebot backdoor, I decided to compare the backdoor functionality of different MEDoc versions to figure out which my personal data might have been already leaked from the MEDoc installation I use now.