Antimalware research for IT pros and enthusiasts – Page 2

Breaking down a notably sophisticated tech support scam M.O.

March 2, 2017 admin Antimalware research for IT pros and enthusiasts, Microsoft Edge, Microsoft SmartScreen, SupportScam, tech support scam, Techbrolo, Windows 10

Credit to Author: msft-mmpc| Date: Fri, 03 Mar 2017 05:39:41 +0000

The cornerstone of tech support scams is the deception that there is something wrong with your PC. To advance this sham, tech support scams have long abused browsers’ full screen function. Coupled with dialogue loops, the pop-up messages that just won’t go away, and the spoofing of brands like Microsoft, tech support scam websites can…

Microsoft Security

MSRT February 2017: Chuckenit detection completes MSRT solution for one malware suite

February 22, 2017 admin Antimalware research for IT pros and enthusiasts, BrowserModifier:Win32/Sasquor, BrowserModifier:Win32/SupTab, Chuckenit, Ghokswa, Malicious Software Removal Tool, Microsoft Malicious Software Removal Tool, MSRT, Sasquor, SupTab, Suweezy, Trojan, Trojan:Win32/Chuckenit.A, Trojan:Win32/Ghokswa, Trojan:Win32/Suweezy, Trojan:Win32/Xadupi, Unwanted software, Windows 10, Windows Defender, Xadupi

Credit to Author: msft-mmpc| Date: Wed, 22 Feb 2017 22:45:06 +0000

In September 2016, we started adding to Microsoft Malicious Software Removal Tool (MSRT) a malware suite of browser modifiers and other Trojans installed by software bundlers. We documented how the malware in this group install other malware or applications silently, without your consent. This behavior ticks boxes in the evaluation criteria that Microsoft Malware Protection…

Microsoft Security

Ransomware: a declining nuisance or an evolving menace?

February 14, 2017 admin Antimalware research for IT pros and enthusiasts, Cerber, CornCrypt, Critorni, Dereilock, Donoff, exploit kit, Locky, Meadgive, Microsoft Edge, Microsoft SmartScreen, Nemucod, Neutrino, ransomware, Samas, spam, spora, Telecrypt, Troldesh, Windows 10, Windows 10 Creators Update, Windows Defender, Windows Defender ATP, Zcryptor

Credit to Author: msft-mmpc| Date: Tue, 14 Feb 2017 21:56:15 +0000

The volume of ransomware encounters is on a downward trend. Are we seeing the beginning of the end of this vicious threat? Unfortunately, a look at the attack vectors, the number of unique families released into the wild, and the improvements in malware code reveals otherwise. Ransomware was arguably the biggest security story of 2016….

Microsoft Security

Improved scripts in .lnk files now deliver Kovter in addition to Locky

February 2, 2017 admin .Lnk embedded PowerShell command, Antimalware research for IT pros and enthusiasts, Kovter, Locky, Powershell, ransomware

Cybercriminals are using a combination of improved script and well-maintained download sites in trying to install Locky and Kovter on more computers. A few months ago, we reported an email campaign distributing .lnk files with a malicious script that downloaded Locky ransomware on target computers. Opening the malicious .lnk files executed a PowerShell script that…

Microsoft Security

Averting ransomware epidemics in corporate networks with Windows Defender ATP

January 30, 2017 admin Advanced persistent threats, Antimalware research for IT pros and enthusiasts, Creators Update, ransomware, Windows 10, Windows Defender, Windows Defender ATP

Microsoft security researchers continue to observe ransomware campaigns blanketing the market and indiscriminately hitting potential targets. Unsurprisingly, these campaigns also continue to use email and the web as primary delivery mechanisms. Also, it appears that most corporate victims are simply caught by the wide nets cast by ransomware operators. Unlike cyberespionage groups, ransomware operators do…

Microsoft Security

Exploit kits remain a cybercrime staple against outdated software – 2016 threat landscape review series

January 23, 2017 admin Angler Exploit Kit, Antimalware research for IT pros and enthusiasts, Axpergle exploit kit, exploit kits, Exploits, Meadgive exploit kit, Microsoft Edge, ransomware, RIG exploit kit, steganography, sundown exploit kit, Windows 10, Windows Defender, Windows Defender ATP, zero-day exploit kit

Despite the disruption of Axpergle (Angler), which dominated the landscape in early 2016, exploit kits as a whole continued to be a threat to PCs running unpatched software. Some of the most prominent threats, from malvertising to ransomware, used exploit kits to infect millions of computers worldwide in 2016. The prevalence of exploit kits as an…

Microsoft Security

Been shopping lately? Fake credit card email can spook you into downloading Cerber ransomware

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, AppLocker Group Policy, Cerber, Device Guard, macro malware, Macro-based malware, malware, malware research, MMPC, ransomware, Social engineering, spam, Windows Defender

As the shopping sprees become increasingly frenetic during holiday season, it’s hard not to worry about how much credit card debt we’re piling. Some of us rely on email notifications from our banks to track the damage to our finances. So what happens when we suddenly get notified about charges for things we never bought?…