Exploits embedded inside Microsoft Office documents such as Word, PDFs and Excel spreadsheets have been at the core of many targeted attacks during the past 24 months. Detection of these attack methods is improving and nimble hackers are recognizing the need for new avenues into enterprise networks. Some have been finding success using rich text format (RTF) files to spread malware that exploits Office vulnerabilities.
With the latest iteration of the Blackhole Exploit Kit hitting the web this week, attackers are going to great lengths to spread around links to get unsuspecting victims to click through to the first version of the kit.
FireEye reported today it had detected a new critical PDF attack targeting the aviation defense industry. Malware Page exploits a stack-based buffer overflow vulnerability in Adobe Acrobat and Adobe Reader. An attacker would be able to execute code remotely via a crafted argument to the getIcon method of a Collab object, according to the CVE alert.
A botnet known as Nitol, built on the backs of PCs and laptops loaded with malware somewhere in the supply chain, was taken down by Microsoft. Microsoft’s Digital Crimes Unit was given permission this week by the U.S. District Court for the Eastern District of Virginia to take over the 3322.org domain and more than 70,000 sub-domains hosting the Nitol botnet.
The developer behind the notorious Black Hole exploit kit has released a new version of the software, adding in several new features designed to prevent security researchers from getting access to new exploits or reverse-engineering the kit’s inner workings. Conveniently, the pricing for Black Hole has stayed the same, so hackers get more value for the same amount of money.
Symantec is warning Android users of a new malicious application posing as a famous Anime character that steals personal contact information stored on the device and sends it to a third party.
Despite seemingly endless pontification, it’s still too early to definitively say whether there’s a connection between the Shamoon malware and recent attacks on Middle Eastern oil firms, yet some of the attackers’ intentions may be getting clearer.
Google made a significant addition to its security lineup Friday with its acquisition of online malware scanning service VirusTotal. Experts say the malware intelligence Google will have at its disposal would enhance not only existing products and services, but will backbone site safety rankings.
Dennis Fisher talks with Al Huger of Sourcefire about the difficulty of tracking down the source of a malware infection, whether organizations should care about attribution after discovering an attack and why playing defense is so difficult.
A strain of malware called Backdoor.LV that uses a custom protocol over port 80 to communicate with its command and control server has been consistently increasing its reach since May, according to a report from FireEye.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
