A dozen US web servers are spreading 10 malware families, Necurs link suspected

guest · Apr 4, 2019

A dozen US web servers are spreading 10 malware families, Necurs link suspected
April 4, 2019
https://www.zdnet.com/article/a-doz...alware-families-necurs-botnet-link-suspected/

Researchers have uncovered over a dozen servers, unusually registered in the United States, which are hosting ten different malware families spread through phishing campaigns potentially tied to the Necurs botnet.

Five families of banking Trojans -- Dridex, Gootkit, IcedID, Nymaim, and Trickbot -- two ransomware variants, Gandcrab and Hermes, as well as three information stealers, Fareit, Neutrino, and Azorult, were all found on the servers.

After tracing the spam and phishing campaigns tied to the malicious infrastructure, Bromium says that email is the main attack vector of all attacks detected. Microsoft Word files containing malicious VBA macros are the weaponized document of choice.
Another interesting element of the infrastructure is the rapid compilation of malware samples and how quickly they were hosted. In some cases, such as with samples of Hermes and Dridex, compilation and hosting would take only a few hours and no longer than 24 hours.
Click to expand...

guest · Apr 5, 2019

mood said: ↑

A dozen US web servers are spreading 10 malware families, Necurs link suspected
April 4, 2019
https://www.zdnet.com/article/a-doz...alware-families-necurs-botnet-link-suspected/
Click to expand...

Bromium Report: Mapping Out a Malware Distribution Network

Log in or Sign up

A dozen US web servers are spreading 10 malware families, Necurs link suspected

guest Guest

guest Guest

Log in or Sign up

A dozen US web servers are spreading 10 malware families, Necurs link suspected

guest Guest

guest Guest

Useful Searches