VB Blog

Research shows web security products perform well against exploit kits

Posted by Martijn Grooten on Aug 24, 2016

Research by Virus Bulletin, in which five web security products were served 54 live exploit kits, shows that the products blocked between 87 and 100 per cent of the kits.

Posted by Helen Martin on Aug 2, 2016

In 1994, along with the Olympic Games came an Olympic virus, from a group of Swedish virus authors calling themselves ‘Immortal Riot’. We look back at Mikko Hyppönen's analysis in the VB archive.

Posted by Martijn Grooten on Aug 1, 2016

Announcing the VB2016 call for last-minute papers and a number of discounts on the conference registration rate.

Posted by Virus Bulletin on Jul 28, 2016

In the run up to VB2016, we invited the conference sponsors to write guest posts for our blog. In the second of this series, ESET's Matías Porolli writes about malicious Visual Basic and JavaScript gaining prevalence in Brazil.

Posted by Martijn Grooten on Jul 28, 2016

The website of the Carol Davila University of Medicine and Pharmacy has been compromised to inject a hidden iframe into the site's source code that serves the Neutrino exploit kit and may infect visitors with ransomware.

Posted by Martijn Grooten on Jul 26, 2016

While there are no actually risks involved in using MD5s in malware analyses, it reinforces bad habits and we should all start using SHA-256 instead.

Posted by Helen Martin on Jul 21, 2016

In 2001, ‘Code Red’ caused White House administrators to change the IP address of the official White House website, and even penetrated Microsoft’s own IIS servers.

Posted by Martijn Grooten on Jul 20, 2016

A new paper by FireEye researcher Ankit Anubhav provides an overview of evasion techniques applied by recently discovered malware.

Posted by Virus Bulletin on Jul 15, 2016

Recently, ESET researchers uncovered a new espionage toolkit targeting targeting Central and Eastern Europe. They provide some details in a guest post.

Posted by Martijn Grooten on Jul 8, 2016

Anti-virus vendor Avast has announced the acquisition of its rival AVG for 1.3 billion US dollars.

Previous1...4243444546...215Next

Search blog

Ebury and Mayhem server malware families still active

Ebury and Mayhem, two families of Linux server malware, about which VB published papers back in 2014, are still active and have received recent updates.
Whether it is to send spam or to redirect web traffic to malicious payloads, compromised (Linux) web servers are the glue in many a malware campaign. Two such networks of… https://www.virusbulletin.com/blog/2017/10/ebury-and-mayhem-server-malware-families-still-active/

Malicious CCleaner update points to a major weakness in our infrastructure

Researchers from Cisco Talos have found that a recent version of the widely used CCleaner tool installed malware on the machine.
For the security community, 2017 might well be called the year of the update: two of the biggest security stories – the WannaCry outbreak and the Equifax breach – involved… https://www.virusbulletin.com/blog/2017/09/malicious-ccleaner-update-points-major-weakness-our-infrastructure/

VB2014 preview: two papers on Linux server malware

Researchers from ESET, Yandex and Symantec look at emerging malware trend.
Researchers from ESET, Yandex and Symantec look at emerging malware trend.In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we are looking at… https://www.virusbulletin.com/blog/2014/09/preview-two-papers-linux-server-malware/

More than two million home routers have 'wide open backdoor'

Default password makes vulnerability easy to exploit.
Default password makes vulnerability easy to exploit. Researchers at Trend Micro have discovered an easy-to-exploit backdoor in routers from Chinese manufacturer Netcore, that… https://www.virusbulletin.com/blog/2014/08/more-two-million-home-routers-have-wide-open-backdoor/

'Son of Stuxnet' trojan found

'Duqu' used in targeted attacks to steal specific information.
'Duqu' used in targeted attacks to steal specific information. Researchers at both Symantec and McAfee have discovered a new Remote Access Trojan (RAT) with strong links to Stuxnet… https://www.virusbulletin.com/blog/2011/10/son-stuxnet-trojan-found/

Fake codec trojan disables anti-virus software

Victim tricked into believing security software still active.
Victim tricked into believing security software still active. A new trojan, discovered by researchers at ESET, spreads itself via fake codecs, then disables running anti-virus… https://www.virusbulletin.com/blog/2011/08/fake-codec-trojan-disables-anti-virus-software/

Hundreds of legitimate websites being hacked into

New mass infection leaves security researchers puzzled.
New mass infection leaves security researchers puzzled. Web security company ScanSafe has reported a new mass infection of websites, which it claims accounts for 15% of the web… https://www.virusbulletin.com/blog/2008/01/hundreds-legitimate-websites-being-hacked/

VB Blog

Research shows web security products perform well against exploit kits

Throwback Thursday: Olympic Games

VB2016 call for last-minute papers opened, discounts announced

Guest Blog: Malicious Scripts Gaining Prevalence in Brazil

Romanian university website compromised to serve Neutrino exploit kit

It's 2016. Can we stop using MD5 in malware analyses?

Throwback Thursday: Holding the Bady

Paper: The Journey of Evasion Enters Behavioural Phase

Guest blog: Espionage toolkit uncovered targeting Central and Eastern Europe

Avast acquires AVG for $1.3bn