malware research – Computer Security Articles

Hunting down Dofoil with Windows Defender ATP

April 4, 2018 admin Advanced hunting, CoinMiner, cryptocurrency mining, cybersecurity, Dofoil, malware research, Namecoin, process hollowing, windows, Windows 10, Windows 10 S, Windows Defender Antivirus, Windows Defender ATP, Windows Defender AV, Windows Defender Exploit Guard

Credit to Author: Windows Defender ATP| Date: Wed, 04 Apr 2018 15:00:18 +0000

Dofoil is a sophisticated threat that attempted to install coin miner malware on hundreds of thousands of computers in March, 2018. In previous blog posts we detailed how behavior monitoring and machine learning in Windows Defender AV protected customers from a massive Dofoil outbreak that we traced back to a software update poisoning campaign several

Microsoft Security

Now you see me: Exposing fileless malware

January 24, 2018 admin cybersecurity, fileless malware, malware research, Powershell, Reflective DLL loading, research, script-based attacks, Windows 10, Windows 10 S, Windows Defender Antivirus, Windows Defender ATP, Windows Defender AV, Windows Defender Exploit Guard

Credit to Author: Windows Defender ATP| Date: Wed, 24 Jan 2018 14:00:21 +0000

Attackers are determined to circumvent security defenses using increasingly sophisticated techniques. Fileless malware boosts the stealth and effectiveness of an attack, and two of last years major ransomware outbreaks (Petya and WannaCry) used fileless techniques as part of their kill chains. The idea behind fileless malware is simple: If tools already exist on a device

Microsoft Security

A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017

January 16, 2018 admin bad rabbit, cloud protection service, cybersecurity, EternalBlue, EternalRomance, Exploits, Hypervisor Code Integrity (HVCI), machine learning, malware research, Microsoft Edge, Microsoft Intelligent Security Graph (ISG), Petya, ransomware, research, Security Intelligence, Security Response, WannaCry, Windows 10, Windows Defender Antivirus, Windows Defender ATP, Windows Defender AV

Credit to Author: Windows Defender ATP| Date: Wed, 10 Jan 2018 14:00:31 +0000

Adopting reliable attack methods and techniques borrowed from more evolved threat types, ransomware attained new levels of reach and damage in 2017. The following trends characterize the ransomware narrative in the past year: Three global outbreaks showed the force of ransomware in making real-world impact, affecting corporate networks and bringing down critical services like hospitals,

Microsoft Security

Microsoft teams up with law enforcement and other partners to disrupt Gamarue (Andromeda)

January 16, 2018 admin Andromeda, anti-virus software, antimalware, Antivirus, antivirus software, Bot, Botnet, botnet takedown, cybersecurity, Digital Crimes Unit, Gamarue, malware research, research, Security Intelligence, Security Response, Windows 10, Windows Defender Antivirus, Windows Defender ATP, Windows Defender AV

Credit to Author: Windows Defender ATP| Date: Mon, 04 Dec 2017 23:06:44 +0000

Today, with help from Microsoft security researchers, law enforcement agencies around the globe, in cooperation with Microsoft Digital Crimes Unit (DCU), announced the disruption of Gamarue, a widely distributed malware that has been used in networks of infected computers collectively called the Andromeda botnet. The disruption is the culmination of a journey that started in

Microsoft Security

Been shopping lately? Fake credit card email can spook you into downloading Cerber ransomware

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, AppLocker Group Policy, Cerber, Device Guard, macro malware, Macro-based malware, malware, malware research, MMPC, ransomware, Social engineering, spam, Windows Defender

As the shopping sprees become increasingly frenetic during holiday season, it’s hard not to worry about how much credit card debt we’re piling. Some of us rely on email notifications from our banks to track the damage to our finances. So what happens when we suddenly get notified about charges for things we never bought?…

Microsoft Security

No payment necessary: Fighting back against ransomware

January 23, 2017 admin Advanced persistent threats, antimalware, Antimalware research for IT pros and enthusiasts, Coordinated Malware Eradication, enterprise software security, malware research, microsoft, Microsoft Edge, MMPC, Product features and announcements, ransomware, research, Windows 10, Windows Defender, Windows Defender ATP, Windows Defender for Windows 10

Any IT professional who’s ever had an experience with malware knows how fast an intrusive attack can happen, and how difficult it can be to educate employees to be vigilant against such threats. And with ransomware attacks only growing, having information, tools and technologies to help protect your network can mean the difference between serious…

Microsoft Security

Fake fax ushers in revival of a ransomware family

January 23, 2017 admin antimalware, Antimalware research for IT pros and enthusiasts, Crimace, enterprise software security, fake fax, malware research, microsoft, Microsoft Edge, MMPC, Ransom:Win32/WinPlock.B, ransomware, research, spam, Trojan, TrojanDownloader:JS/Crimace.A, Windows 10, Windows Defender, Windows Defender for Windows 10, WinPlock

“Criminal case against you” is a message that may understandably cause panic. That’s what a recent spam campaign hopes happens, increasing the likelihood of recipients opening the malicious attachment. We recently discovered a new threat that uses email messages pretending to be fax messages, but in truth deliver a ransomware downloader. The attachment used in this…

Microsoft Security

Malicious macro using a sneaky new trick

January 23, 2017 admin antimalware, Antimalware research for IT pros and enthusiasts, Donoff, guidance, Locky, macro, Macro-based malware, malware, malware research, office, ransomware, Social engineering, VBA, VBAscript, Windows 10, Windows Defender, Word

We recently came across a file (ORDER-549-6303896-2172940.docm, SHA1: 952d788f0759835553708dbe323fd08b5a33ec66) containing a VBA project that scripts a malicious macro (SHA1: 73c4c3869304a10ec598a50791b7de1e7da58f36). We added it under the detection TrojanDownloader:O97M/Donoff – a large family of Office-targeting macro-based malware that has been active for several years (see our blog category on macro-based malware for more blogs). However, there wasn’t…

← Previous