VB Blog

Patch early, patch often, but don't blindly trust every 'patch'

Posted by   Martijn Grooten on   Apr 16, 2018

Compromised websites are being used to serve fake Flash Player uploads that come with a malicious payload.

Read more  

Virus Bulletin at RSA

Posted by   Martijn Grooten on   Apr 13, 2018

Next week, VB Editor Martijn Grooten will be at the RSA Conference in San Francisco.

Read more  

Broad-ranging and international VB2018 programme announced

Posted by   Martijn Grooten on   Apr 11, 2018

VB is excited to reveal the details of an interesting and diverse programme for VB2018, the 28th Virus Bulletin International Conference, which takes place 3-5 October in Montreal, Canada.

Read more  

Netflix issue shows email verification really does matter

Posted by   Martijn Grooten on   Apr 10, 2018

A clever trick taking advantage of the fact that Gmail ignores dots in email addresses could be used to trick someone into paying for your Netflix subscription - demonstrating the importance of confirmed opt-in.

Read more  

VB2017 paper: Exploring the virtual worlds of advergaming

Posted by   Martijn Grooten on   Apr 10, 2018

At VB2017 in Madrid, Malwarebytes' Chris Boyd presented a paper in which he looked at various aspects of advergaming, from unreadable EULAs to fake programs that promise to block ads. Today, we publish both the paper and the recording of Chris's presentation.

Read more  

New paper: Distinguishing between malicious app collusion and benign app collaboration: a machine-learning approach

Posted by   Martijn Grooten on   Mar 27, 2018

Two or more mobile apps, viewed independently, may not appear to be malicious - but in combination, they could become harmful by exchanging information with one another and by performing malicious activities together. Today, we publish a new paper by a group of researchers affiliated with various UK universities and companies, which looks at how machine-learning methods can be used to detect app collusions.

Read more  

VB2016 paper: Wild Android collusions

Posted by   Martijn Grooten on   Mar 26, 2018

At VB2016 in Denver, Jorge Blasco presented a paper (co-written with Thomas M. Chen, Igor Muttik and Markus Roggenbach), in which he discussed the concept of app collusion - where two (or more) apps installed on the same device work together to collect and extract data from the device - and presented discoveries of colluding code in many in-the-wild apps. Today, we publish both the paper and the recording of Jorge's presentation.

Read more  

VB2017 paper: The life story of an IPT - Inept Persistent Threat actor

Posted by   Martijn Grooten on   Mar 19, 2018

At VB2017 in Madrid, Polish security researcher and journalist Adam Haertlé presented a paper about a very inept persistent threat. Today, we publish both the paper and the recording of Adam's presentation.

Read more  

Five reasons to submit a VB2018 paper this weekend

Posted by   Martijn Grooten on   Mar 16, 2018

The call for papers for VB2018 closes on 18 March, and while we've already received many great submissions, we still want more! Here are five reasons why you should submit a paper this weekend.

Read more  

First partners of VB2018 announced

Posted by   Martijn Grooten on   Mar 15, 2018

We are excited to announce the first six companies to partner with VB2018.

Read more  

Search blog

VB2019 papers: Emotet and Ryuk

Today we publish VB2019 papers by Luca Nagy (Sophos) on Emotet and Gabriela Nicolao and Luciano Martins (Deloitte) on Ryuk, as well as the corresponding videos of their presentations.
Shinigami’s revenge: the long tail of the Ryuk malware Read the paper (HTML) Download the paper (PDF)   Exploring Emotet, an elaborate everyday enigma Read the paper… https://www.virusbulletin.com/blog/2019/10/vb2019-papers-emotet-and-ryuk/

VB2019 preview: Exploring Emotet, an elaborate everyday enigma

We preview the VB2019 paper by Sophos researcher Luca Nagy, who dives deeply into the notorious Emotet malware.
Active since 2014, initially as a banking trojan, Emotet has been a plague on the Internet in recent years. Emotet's core strength is its ability to download other malware, thus… https://www.virusbulletin.com/blog/2019/08/vb2019-preview-exploring-emotet-elaborate-everyday-enigma/

VB2018 paper: Office bugs on the rise

At VB2018 Sophos researcher Gábor Szappanos provided a detailed overview of Office exploit builders, and looked in particular at the widely exploited CVE-2017-0199. Today we publish his paper and release the video of his presentation.
A large portion of today's malware infections use malicious Office documents as a first-stage payload. Typically, the user is tricked into enabling macros or disabling some… https://www.virusbulletin.com/blog/2018/12/vb2018-paper-office-bugs-rise/

VB2018 video: Behind the scenes of the SamSam investigation

Today we have published the video of the VB2018 presentation by Andrew Brandt (Sophos) on the SamSam ransomware, which became hot news following the indictment of its two suspected authors yesterday.
Yesterday, a federal grand jury in the US unsealed an indictment charging two Iranians with being behind the SamSam ransomware. SamSam has been one of the most successful… https://www.virusbulletin.com/blog/2018/11/vb2018-video-behind-scenes-samsam-investigation/

Gábor Szappanos wins fourth Péter Szőr Award

At the VB2017 gala dinner, the fourth Péter Szőr Award was presented to Sophos researcher Gábor Szappanos for his paper "AKBuilder – the crowdsourced exploit kit".
Every year, during the Virus Bulletin Conference gala dinner, we celebrate the life and works of Péter Szőr, the brilliant security researcher who passed away so sadly in 2013. We… https://www.virusbulletin.com/blog/2017/10/gabor-szappanos-wins-fourth-peter-szor-award/

Paper: New Keylogger on the Block

In a new paper published by Virus Bulletin, Sophos researcher Gabor Szappanos takes a look at the KeyBase keylogger, sold as a commercial product and popular among cybercriminals who use it in Office exploit kits.
Keyloggers have long been a popular tool for cybercriminals, something made worse by the fact that many of them are sold commercially. Today, we publish a paper (here as a PDF)… https://www.virusbulletin.com/blog/2016/07/paper-new-keylogger-block/

VB2015 paper: Will Android Trojans, Worms or Rootkits Survive in SEAndroid and Containerization?

Sophos researchers Rowland Yu and William Lee look at whether recent security enhancements to Android, such as SEAndroid and containerization, will be enough to defeat future malware threats.
Google's Android operating system may have a bit of a bad reputation when it comes to security, but it's worth noting that recent versions of the operating system have been… https://www.virusbulletin.com/blog/2016/02/vb2015-paper-will-android-trojans-worms-or-rootkits-survive-seandroid-and-containerization/

Sophos red flags Google Analytics

Popular analytics tool mistakenly flagged as 'high risk'.
Popular analytics tool mistakenly flagged as 'high risk'. Security firm Sophos had an embarrassing moment this morning when its scanner flagged Google Analytics as malicious.… https://www.virusbulletin.com/blog/2011/06/sophos-red-flags-google-analytics/

Sophos joins free home AV crowd with Mac release

Business-focused firm takes first step into home-user arena.
Business-focused firm takes first step into home-user arena.Sophos has announced the release of a home-user edition of its Mac anti-malware solution, which is being given away free… https://www.virusbulletin.com/blog/2010/11/sophos-joins-free-home-av-crowd-mac-release/

Sophos bought up by investment firm

APAX Partners acquires major stake in $830 million company.
APAX Partners acquires major stake in $830 million company.Sophos has announced that a majority share of the company will be sold to major private investment firm APAX Partners, in… https://www.virusbulletin.com/blog/2010/05/sophos-bought-investment-firm/

AV protection free for aliens

Klingon language scanner given away.
Klingon language scanner given away. After last summer saw malware making its way into space, it seemed like only a matter of time before alien races would need protection from the… https://www.virusbulletin.com/blog/2009/05/av-protection-free-aliens/

Tough weekend for AV giants as FPs and DNS issues hit

Trend false alert cripples users' systems, Sophos sites taken out by DNS mixup.
Trend false alert cripples users' systems, Sophos sites taken out by DNS mixup. Two of the larger security firms, Trend Micro and Sophos, had a busy weekend cleaning up after… https://www.virusbulletin.com/blog/2008/09/tough-weekend-av-giants-fps-and-dns-issues-hit/

Sophos makes move to buy Utimaco

€217 million bid launched for encryption specialist.
€217 million bid launched for encryption specialist. Security light-heavyweight Sophos has issued official notice of its intention to buy German encryption firm Utimaco, in a share… https://www.virusbulletin.com/blog/2008/07/sophos-makes-move-buy-utimaco/

41 months plus hefty fine for botherder

Cross-border operation brings adware crook to book.
Cross-border operation brings adware crook to book. A Florida man has been sentenced to 41 months in prison and fined $65,000 (approx. £32,000) after implanting bot software on… https://www.virusbulletin.com/blog/2008/06/41-months-plus-hefty-fine-botherder/

Almost half of users think virus-writing contests are a good idea

Shocking survey results disappoint security experts.
Shocking survey results disappoint security experts. Nearly half of the respondents in a Virus Bulletin poll said they thought that virus-writing contests are a useful way of… https://www.virusbulletin.com/blog/2008/05/almost-half-users-think-virus-writing-contests-are-good-idea/

Sophos announces plans to float

Listing on London Stock Exchange expected soon.
Listing on London Stock Exchange expected soon. The long-anticipated floatation of Sophos, one of the biggest privately owned security firms, has been announced this week, with the… https://www.virusbulletin.com/blog/2007/11/sophos-announces-plans-float/

Minor flaws patched in Sophos AV

Security vulnerabilities found and fixed.
Security vulnerabilities found and fixed. Two separate flaws have been reported in Sophos's anti-virus engine, affecting most of its product range and allowing security bypass and… https://www.virusbulletin.com/blog/2007/09/minor-flaws-patched-sophos-av/

Phish poses as Sophos malware alert

Fake security alarm lures users to spoofed site.
Fake security alarm lures users to spoofed site. A phishing email recently spammed out uses the name of security firm Sophos to lend credence to a fake malware alert, designed to… https://www.virusbulletin.com/blog/2007/08/phish-poses-sophos-malware-alert/

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.