article thumbnail

Unknown FinSpy Mac and Linux versions found in Egypt

Security Affairs

Since 2011 it was employed in attacks aimed at Human Rights Defenders (HRDs) in many countries, including Bahrain, Ethiopia, UAE, and more. ” continues the analysis. FinSpy can spy on most popular desktop and mobile operating systems, including Android, iOS, Windows, macOS, and Linux.

article thumbnail

DePriMon downloader uses a never seen installation technique

Security Affairs

According to a report published by Symantec in 2017, Longhorn is a North American hacking group that has been active since at least 2011. The second stage installs itself and loads the third stage using an encrypted, hardcoded path. ” reads the analysis. “The described installation technique is unique.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

SHARED INTEL: How ransomware evolved from consumer trickery to deep enterprise hacks

The Last Watchdog

Although most people think of ransomware as a dodgy application that encrypts data and holds it for ransom, the concept is much more heterogeneous than that. File encryption 2013 – 2015. It emerged in September 2013 and paved the way for hundreds of file-encrypting menaces that have splashed onto the scene ever since.

article thumbnail

YTStealer info-stealing malware targets YouTube content creators

Security Affairs

The malware encrypts all the data with a key that is unique for each sample and sends it along with a sample identifier to the C2 server located at the domain name youbot[.]solutions. Aparat is an Iranian video-sharing site that was founded in 2011. ” “The business listing has a logo of an eye in a red circle.

article thumbnail

Antlion APT group used a custom backdoor that allowed them to fly under the radar for months

Security Affairs

” reads the analysis published by the Broadcom-owned company Symantec. The xPack backdoor is a.NET loader that fetches and executes AES-encrypted payloads, it supports multiple commands. Symantec speculates Antlion is has been active since at least 2011, its TTP overlaps the ones associated with China-linked nation-state actors.

article thumbnail

Taking down Gooligan: part 2 — inner workings

Elie

This post provides an in-depth analysis of the inner workings of Gooligan, the infamous Android OAuth stealing botnet. This file is encrypted with a hardcoded [XOR encryption] function. This encryption is used to escape the signatures that detect the code that Gooligan borrows from previous malware. since at least 2011.

article thumbnail

Taking down Gooligan: part 2 — inner workings

Elie

This post provides an in-depth analysis of the inner workings of Gooligan, the infamous Android OAuth stealing botnet. This file is encrypted with a hardcoded [XOR encryption] function. This encryption is used to escape the signatures that detect the code that Gooligan borrows from previous malware. since at least 2011.