VB Blog

Alleged author of creepy FruitFly macOS malware arrested

Posted by   Martijn Grooten on   Jan 11, 2018

A 28-year old man from Ohio has been arrested on suspicion of having created the mysterious FruitFly malware that targeted macOS and used it to spy on its victims.

Read more  

The threat and security product landscape in 2017

Posted by   Martijn Grooten on   Jan 10, 2018

At the start of the new year, Virus Bulletin looks back at the threats seen in the 2017 and at the security products that are available to help mitigate them.

Read more  

Spamhaus report shows many botnet controllers look a lot like legitimate servers

Posted by   Martijn Grooten on   Jan 9, 2018

Spamhaus's annual report on botnet activity shows that botherders tend to use popular, legitimate hosting providers, domain registrars and top-level domains when setting up command-and-control servers.

Read more  

Tips on researching tech support scams

Posted by   Martijn Grooten on   Jan 5, 2018

As tech support scammers continue to target the computer illiterate through cold calling, VB's Martijn Grooten uses his own experience to share some advice on how to investigate such scams.

Read more  

Meltdown and Spectre attacks mitigated by operating system updates

Posted by   Martijn Grooten on   Jan 4, 2018

Just four days into the new year, two serious attacks in modern processors, dubbed Meltdown and Spectre, have been discovered. The attacks can be mitigated by patches to the operating system, but anti-virus software vendors need to make sure their products are compatible with the patches.

Read more  

Conference review: AVAR 2017

Posted by   Martijn Grooten on   Dec 22, 2017

Martijn Grooten reports on the 20th AVAR conference, which took place earlier in December in Beijing, China.

Read more  

Conference review: Botconf 2017

Posted by   Virus Bulletin on   Dec 22, 2017

Virus Bulletin researchers report back from a very interesting fifth edition of Botconf, the botnet fighting conference.

Read more  

VB2017 videos on attacks against Ukraine

Posted by   Martijn Grooten on   Dec 21, 2017

(In)security is a global issue that affects countries around the world, but in recent years none has been so badly hit as Ukraine. Today, we publish the videos of two VB2017 talks about attacks that hit Ukraine particularly badly: a talk by Alexander Adamov (NioGuard) on (Not)Petya and related attacks, and another by Robert Lipovsky and Anton Cherepanov (ESET) on Industroyer.

Read more  

Facebook helps you determine whether emails really came from its servers

Posted by   Martijn Grooten on   Dec 21, 2017

On its website, Facebook now shows which emails it has sent you recently, thus helping you to determine which emails are real, and which should be discarded as phishing.

Read more  

Vulnerability disclosure and botnet takedown not to be hindered by Wassenaar Arrangement

Posted by   Martijn Grooten on   Dec 19, 2017

Clarification in the language of the Wassenaar Arrangement, a multilateral export control regime for conventional arms and dual-use goods and technologies, means those involved in vulnerability disclosure or botnet takedown won't have to worry about acquiring an export licence.

Read more  

Search blog

VB2019 paper: Pulling the PKPLUG: the adversary playbook for the long-standing espionage activity of a Chinese nation state adversary

The activities of China-based threat actor PKPLUG were detailed in a VB2019 paper by Palo Alto Networks researcher Alex Hinchliffe, who described the playbook of this long-standing adversary. Today we publish both Alex's paper and the recording of his pre…
Pulling the PKPLUG: the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary Read the paper (HTML) Download the paper (PDF)    … https://www.virusbulletin.com/blog/2020/03/vb2019-paper-pulling-pkplug-adversary-playbook-long-standing-espionage-activity-chinese-nation-state-adversary/

VB2019 paper: Exploring the Chinese DDoS landscape

China has long been a hotbed of DDoS activities, and today we publish a VB2019 paper by Intezer researcher Nacho Sanmillan who looked at Chinese threat groups engaged in performing DDoS attacks. We have also uploaded the recording of his presentation.
Exploring the Chinese DDoS landscape Read the paper (HTML) Download the paper (PDF)       China has long been a hotbed of DDoS activities, with several groups… https://www.virusbulletin.com/blog/2019/12/vb2019-paper-exploring-chinese-ddos-landscape/

Conference review: AVAR 2017

Martijn Grooten reports on the 20th AVAR conference, which took place earlier in December in Beijing, China.
The first week of December was packed with security conferences, and VB2017 speakers were busy presenting their research at no fewer than four different events: FIRST in Prague,… https://www.virusbulletin.com/blog/2017/12/conference-review-avar-2017/

By removing VPNs from its Chinese App Store, Apple turns its biggest security asset against its users

To comply with Chinese laws, Apple has removed all iOS VPN apps from its Chinese app store. This means that the company uses iOS's strongest security asset, its tightly controlled App Store, against its own users.
A little over a month ago, Apple's iPhone celebrated its tenth birthday. The iPhone has been one of the biggest commercial success stories ever, but it has also been a great… https://www.virusbulletin.com/blog/2017/08/removing-vpns-its-chinese-app-store-apple-turns-its-biggest-security-asset-aggasnt-its-users/

Small Talks return to the Virus Bulletin Conference

Following their success last year, this year a series of "Small Talks" return to the VB2016 conference programme. We are pleased to announce the details of six of these talks, covering subjects that range from the Chinese cybercriminal underground to Andr…
VB2015 was the 25th Virus Bulletin conference and, to celebrate the occasion, we added a third stream to the programme. Dubbed "Small Talks", these talks were longer than those on… https://www.virusbulletin.com/blog/2016/08/small-talks-return-virus-bulletin-conference/

WireLurker malware infects iOS devices through OS X

Non-jailbroken devices infected via enterprise provisioning program.
Non-jailbroken devices infected via enterprise provisioning program. Researchers at Palo Alto Networks have published a research paper (PDF) analysing the 'WireLurker' malware that… https://www.virusbulletin.com/blog/2014/11/wirelurker-malware-infects-ios-devices-through-os-x/

Hundreds of APTs linked to Chinese Army department

'Unit 61398' employs hundreds of people.
'Unit 61398' employs hundreds of people. A new report by security firm Mandiant links a large number of cyber-espionage cases to a department of the Chinese army. The report is… https://www.virusbulletin.com/blog/2013/02/hundreds-apts-linked-chinese-army-department/

Significant rise in Chinese phishing sites

Phishers shown to care little about domain names.
Phishers shown to care little about domain names. In its latest 'Global Phishing Survey', the Anti-Phishing Working Group (APWG) reports a significant increase in phishing sites… https://www.virusbulletin.com/blog/2011/11/significant-rise-chinese-phishing-sites/

Chinese whispers of malware writing and bribery in the industry

As China corruption scandals rumble on, more rumours of malware writers in AV firms surface.
As China corruption scandals rumble on, more rumours of malware writers in AV firms surface. Several recent stories in the media have revolved around China and malware writers,… https://www.virusbulletin.com/blog/2010/12/chinese-whispers-malware-writing-and-bribery-industry/

More than 1 million Chinese phones infected with malware

Mobile botnet sending out SMS spam.
Mobile botnet sending out SMS spam. Over one million mobile phones in China have been infected with malware and are sending out SMS spam, the Shanghai Daily reports. Masquerading… https://www.virusbulletin.com/blog/2010/11/more-1-million-chinese-phones-infected-malware/

Spammers move from China to Russia

Stricter rules on registering .cn domains leads to increase in malicious .ru domains.
Stricter rules on registering .cn domains leads to increase in malicious .ru domains. A change in the rules of the organization responsible for registering .cn domains has resulted… https://www.virusbulletin.com/blog/2010/02/spammers-move-china-russia/

China hosting over half of malicious sites

StopBadware.org report highlights Chinese dominance in web malware.
StopBadware.org report highlights Chinese dominance in web malware. A report from StopBadware.org released last week found that 52% of malicious websites were hosted in China, with… https://www.virusbulletin.com/blog/2008/06/china-hosting-over-half-malicious-sites/

China-Tibet row spills over into malware attacks

Both sides of debate targeted to spread malicious code.
Both sides of debate targeted to spread malicious code. With the political row over China's involvement in Tibet continuing to make the headlines, cybercriminals have been as quick… https://www.virusbulletin.com/blog/2008/04/china-tibet-row-spills-over-malware-attacks/

UK spooks spooked by possible Chinese hacking

MI5 warns of suspected corporate espionage onslaught.
MI5 warns of suspected corporate espionage onslaught. The UK security service MI5 has issued an alert to 300 leading firms, warning them to ensure best possible security measures… https://www.virusbulletin.com/blog/2007/12/uk-spooks-spooked-possible-chinese-hacking/

Infected Seagate hard drives sold in Taiwan

External Maxtor disks shipped carrying autorun datastealer.
External Maxtor disks shipped carrying autorun datastealer. A shipment of Maxtor external hard drives, produced in Thailand by US-based Seagate and sold in Taiwan, has been found… https://www.virusbulletin.com/blog/2007/11/infected-seagate-hard-drives-sold-taiwan/

Fujacks/Panda virus authors sentenced, offered job

Fujacks author put away for four years.
Fujacks author put away for four years. Four men who were charged last month with writing, selling and spreading the W32/Fujacks virus and worm (a.k.a. the 'Panda burning… https://www.virusbulletin.com/blog/2007/09/fujacks-panda-virus-authors-sentenced-offered-job/

China denies Pentagon hacking claims

'Hacked by Chinese' row rumbles on.
'Hacked by Chinese' row rumbles on. The Chinese government has vigorously denied accusations, made in a report in UK newspaper The Financial Times on Monday, that Chinese hackers… https://www.virusbulletin.com/blog/2007/09/china-denies-pentagon-hacking-claims/

Four charged with writing Fujacks

Malware authors and sellers appear in Chinese court.
Malware authors and sellers appear in Chinese court. Four men have appeared in a public court in Hubei Province, China, charged with writing, selling and spreading the W32/Fujacks… https://www.virusbulletin.com/blog/2007/08/four-charged-writing-fujacks/

China steps up fight against spammers

Blacklist aims to reduce massive spamming levels.
Blacklist aims to reduce massive spamming levels. Chinese web organisation the Internet Society of China (ISC) has announced the setting up of a central anti-spam blacklist, to… https://www.virusbulletin.com/blog/2007/06/china-steps-fight-against-spammers/

Symantec sued for false positive

Chinese FP issue leads to court case.
Chinese FP issue leads to court case. A Chinese lawyer has begun court proceedings against security firm Symantec, claiming damages as a result of the widely-publicised false… https://www.virusbulletin.com/blog/2007/06/symantec-sued-false-positive/

« Previous 12 Next »

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.