article thumbnail

New ZHtrap botnet uses honeypot to find more victims

Security Affairs

Netlab 360 experts discovered a new Mirai-based botnet dubbed ZHtrap that implements honeypot to find more victims. Researchers from Netlab 360 discovered a new Mirai-based botnet dubbed ZHtrap that implements honeypot to find more victims. ” reads the analysis published by Netlab 360. Pierluigi Paganini.

article thumbnail

Analysis of the FBI’s Anom Phone

Schneier on Security

Motherboard got its hands on one of those Anom phones that were really FBI honeypots. The details are interesting.

Honeypots 141
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

TeamTNT is back and targets servers to run Bitcoin encryption solvers

Security Affairs

In the first week of September, AquaSec researchers identified at least three different attacks targeting their honeypots, the experts associated them with the cybercrime gang TeamTNT. ” reads the analysis published by AquaSec. “Breaking the cryptographic encryption is considered “Mission: Impossible”. be on IP 93[.]95[.]229[.]203).”

article thumbnail

New Go malware Capoae uses multiple flaws to target WordPress installs, Linux systems

Security Affairs

The researchers discovered the threat after a sample of the malware targeted one Akamai honeypot. The attackers dropped a PHP malware sample through a backdoor linked to a WordPress plugin called Download-monitor, which was installed after the honeypot was accessed. ” concludes the analysis. Pierluigi Paganini.

Honeypots 100
article thumbnail

B1txor20 Linux botnet use DNS Tunnel and Log4J exploit

Security Affairs

The malware was first spotted on February 9, 2022, when 360Netlab’s honeypot system captured an unknown ELF file that was spreading by exploiting the Log4J vulnerability. The name B1txor20 is based on the file name “b1t” used for the propagation and the XOR encryption algorithm, and the RC4 algorithm key length of 20 bytes.

Honeypots 137
article thumbnail

Experts spotted a backdoor that borrows code from CIA’s Hive malware

Security Affairs

One of the 360Netlab’s honeypot caught a suspicious ELF file on October 2021, the experts reported that the malware was spread by exploiting F5 zero-day exploit. Additional analysis revealed that the malware borrows code from the Hive project that was leaked in 2017 as part of Vault 8 series. . Pierluigi Paganini.

article thumbnail

Roboto, a new P2P botnet targets Linux Webmin servers

Security Affairs

In October one of the honeypots of the company captured the bot, its downloader , and some bot modules. “Fast forwarded to October 11, 2019, our Anglerfish honeypot captured another suspicious ELF sample, and it turned out to be the Downloader of the previous suspicious ELF sample.” ” reads the analysis.