Hackers spread TVRAT malware through compromised Windows ISS servers

guest · Sep 21, 2021

Hackers spread TVRAT malware through compromised Windows ISS servers
September 21, 2021
https://gadgettendency.com/hackers-spread-tvrat-malware-through-compromised-windows-iss-servers/

Hackers install malware through fake certificate expired notifications.

Attackers break into Windows Internet Information Services (IIS) servers and inject certificate expiration pages prompting you to install software that is actually a malware installer. The malicious program automatically installs and starts the TeamViewer remote control program. Once launched, the TeamViewer server contacts the attackers’ C&C server.

“A potential security threat has been identified and the transition to [имя сайта]… Updating the security certificate may allow this connection to be established. NET :: ERR_CERT_OUT_OF_DATE “, – is reported in the notification on the pages.
Click to expand...

How noted cybersecurity researchers from Malwarebytes Threat Intelligence use a fake Digicert-signed update installer to install the TVRAT malware (also known as TVSPY, TeamSpy, TeamViewerENT or Team Viewer RAT) on the victim’s computer. The malware provides operators with full remote access to infected hosts.
Click to expand...

Log in or Sign up

Hackers spread TVRAT malware through compromised Windows ISS servers

guest Guest

Log in or Sign up

Hackers spread TVRAT malware through compromised Windows ISS servers

guest Guest

Useful Searches