A malware campaign was recently detected in Brazil, distributing a malicious LNK file using WhatsApp. It targets mainly Brazilians and uses Portuguese-named URLs.
To evade detection, the command-and-control (C2) server verifies each download to ensure it originates from the malware itself. The whole infection chain is complex and fully fileless, and by the end, it will deliver a new banking Trojan named Maverick, which contains many code overlaps with Coyote. In this blog post, we detail the entire infection chain, encryption algorithm, and its targets, as well as discuss the similarities with known threats.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Voice cloning of growing interest to actors and cybercriminals
July 12, 2021
As voice cloning technology has become ever more effective, it is of increasing interest to actors… and cybercriminals. When Tim Heller first heard his cloned voice he says it was so accurate that “my jaw hit the floor… it was mind-blowing”. Voice cloning is when a computer program is used to generate a synthetic, adaptable copy of ...
- Insurance giant CNA reports data breach after ransomware attack
July 9, 2021
CNA Financial Corporation, a leading US-based insurance company, is notifying customers of a data breach following a Phoenix CryptoLocker ransomware attack that hit its systems in March. CNA is considered the seventh-largest commercial insurance firm in the US based on stats from the Insurance Information Institute. Read more… Source: Bleeping Computer
- Biden tells Putin the U.S. will take ‘any necessary action’ after latest ransomware attack
July 9, 2021
President Biden told Russian President Vladimir Putin on Friday that the United States will take “any necessary action” to defend U.S. infrastructure, the White House said, after Russia-based hackers carried out the largest known ransomware attack to date. Biden has been under increasing pressure to counter such costly, brazen assaults — pressure that spiked last weekend ...
- Morgan Stanley reports data breach after vendor Accellion hack
July 8, 2021
Investment banking firm Morgan Stanley has reported a data breach after attackers stole personal information belonging to its customers by hacking into the Accellion FTA server of a third-party vendor. Morgan Stanley is a leading global financial services firm providing investment banking, securities, wealth and investment management services worldwide. Read more… Source: Bleeping Computer
- Understanding REvil: The Ransomware Gang Behind the Kaseya Attack
July 6, 2021
REvil has emerged as one of the world’s most notorious ransomware operators. In just the past month, it extracted an $11 million payment from the U.S. subsidiary of the world’s largest meatpacking company based in Brazil, demanded $5 million from a Brazilian medical diagnostics company and launched a large-scale attack on dozens, perhaps hundreds, of ...
- US warns of action against ransomware gangs if Russia refuses
July 6, 2021
White House Press Secretary Jen Psaki says that the US will take action against cybercriminal groups from Russia if the Russian government refuses to do so. Psaki added that the recent REvil ransomware attack on Florida-based IT company Kaseya is not yet attributed to anyone, specifically not to the Russian government. Read more… Source: Bleeping Computer