As researchers continue to pull apart the Gauss malware code, looking for spreading mechanisms and infection vectors, there is still some work being done on Gauss’s cousin Flame, as well. New research from CERT Polska reveals how deeply Flame burrows itself into infected systems, showing that the malware injects various pieces of its code into three threads and hiding its operations behind commonly seen and legitimate processes.
One of the many mysteries around the discovery of the Gauss malware is why the tool installs a new font called Palida Narrow on infected machines. Researchers have been unable to figure out yet what the purpose of the font is, but as its presence on a PC is a good indicator of a Gauss infection, CrySyS Lab and Kaspersky Lab today released a tool to detect it.
While much of the world was focused yesterday on the Gauss malware saga, there was another interesting infection happening, mainly in the Netherlands, that researchers think may be related to the Zeus and Citadel attacks, though the motivation behind the attack is somewhat of a mystery. The new malware, called Dorifel, has infected thousands of businesses in the Netherlands and Europe and researchers say that it’s stealing online banking data and the crew behind it may be working on some other attack campaigns, as well.
The FBI today warned of Internet-borne malware masquerading as a message from the law enforcement agency that locks computers until the user pays a fine for allegedly downloading and/or distributing illegal content.
A new piece of malware dubbed Gauss, that experts say is a direct descendant of Flame and also related to Stuxnet and Duqu, has been found on thousands of PCs in the Middle East, mostly in Lebanon. Gauss contains some of the same code as Flame, but is markedly different in a number of respects, specifically in its ability to steal online banking credentials and has an encrypted payload that experts haven’t yet been able to crack. Researchers say that Gauss is almost certainly the work of the same team that wrote the Flame malware, which they speculate is a state-sponsored group.
If a recent poll of 1,000 security professionals is any indication, there remains a significant learning gap in understanding advanced persistent threats – and therefore building a strong defense to resist them.
Researchers have uncovered another in an ongoing series of targeted attacks against government agencies and activists, this time an attack that compromised a pair of Nepalese government web sites with code that exploits a Java vulnerability to install a backdoor on vistors’ machines.
Do not envy the life of a Web app. It’s a brutal, public existence filled with attacks from all sides. In fact, a new report by Imperva sheds some light on this sad life, showing that a typical Web app is attacked once every three days and some are targeted as many as 2,700 times in a given year.
South Korea for the first time topped PandaLabs’ quarterly ranking of countries with the highest number of infected computers. The nation’s PC infection rate stood at 57.3 percent for Q2, followed by China at almost 52 percent and Taiwan at 42 percent.
One of the more pernicious and as-yet incurable diseases in security is the resistance to sharing data. Organizations large and small collect all sorts of information on attacks, vulnerabilities and threats and, for the most part, it simply sits in databases and is never of any use to anyone outside of the organization. But there’s an effort underway at the Georgia Tech Research Institute to change that through the use of a new information-gathering and analysis system called Titan.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
