Analysis of TeleBots’ cunning backdoor

On the 27th of June 2017, a new cyberattack hit many computer systems in Ukraine, as well as in other countries. That attack was spearheaded by the malware ESET products detect as Diskcoder.C(aka ExPetr, PetrWrap, Petya, or NotPetya). This malware masquerades as typical ransomware: it encrypts the data on the computer and demands $300 bitcoins for recovery. In fact, … More Analysis of TeleBots’ cunning backdoor

Four arrested as Microsoft and UK police team up to crack down on technical support scammers

Four people have been arrested after a two-year investigation by Microsoft and British police forces into telephone scams which prey upon the vulnerable, tricking them into believing their computers have been infected by malware. In a typical technical support scam operation, fraudsters will work their way through the telephone book, ringing up people under the … More Four arrested as Microsoft and UK police team up to crack down on technical support scammers

All you need to know about the worldwide ‘Petya’ ransomware attacks

ESET Ireland wrote about Petya ransomware last year, a new variant massive cyberattack struck on June 27th. ESET LiveGrid technology detects the Petya malware as Win32/Diskcoder.C. If you have a default install of any modern ESET product, ESET would protect against this threat. Additionally, any ESET product with network detection would protect from the SMB spreading … More All you need to know about the worldwide ‘Petya’ ransomware attacks

Birthday Reminder looks benign but the devil’s in the details: Hooks DNS, serves dodgy ads

The strange behavior of a simple Windows application caught our attention and sparked ESET’s analysis of previously undocumented malware. A contact at the Norwegian HealthCERT —  following a question about this from the regional healthcare provider Sykehuspartner — reached out to us asking about DNS queries to domains with the format [0-9a-f]{60}.smoke. There is no .smoketop level domain, … More Birthday Reminder looks benign but the devil’s in the details: Hooks DNS, serves dodgy ads