October 7, 2019 By David Bisson 3 min read

Last week in security news, researchers unveiled how a malvertising actor known as eGobbler exploited browser bugs to infect more than 1 billion ad impressions over a two-month period. Security experts also analyzed the emergence of a new cryptocurrency stealer and an internet of things (IoT) botnet capable of launching different distributed denial-of-service (DDoS) attacks. In addition, analysts uncovered new attack campaigns for more established threats, including Emotet and Adwind.

Top Story of the Week: eGobbler Abuses Browser Bugs in Malvertising Attacks

In mid-April, Confiant observed eGobbler abusing a Chrome exploit to bypass the browser’s pop-up blocker that came built-in on iOS devices. Researchers reported that vulnerability to the Chromium team, which patched the issue less than two months later.

Shortly thereafter, the security firm came across a similar vulnerability pertaining to WebKit browsers. Confiant informed both the Chrome and Apple teams about the second security issue in early August — both implemented fixes by the end of September. Within that two-month period, however, the malvertising threat managed to infect 1.16 billion ad impressions.

Source: iStock

Also in Security News

  • Masad Stealer Replaces Clipboard Info to Steal Cryptocurrency: Researchers at Juniper Labs observed a family of malware called Masad Stealer replacing the clipboard information in victims’ browsers with cryptocurrency wallets under attackers’ control. Juniper Labs also identified the threat’s use of Telegram to steal information, including usernames, passwords and credit card data.
  • Gucci IoT Botnet Capable of Launching Different DDoS Attacks: SecNiche Security Labs used automation to authenticate themselves with the command-and-control (C&C) panel for the Gucci IoT botnet. In that panel, researchers found they could command Gucci to perform a variety of DDoS attacks, such as UDP flood, SYN flood and ACK flood.
  • Attackers Use FakeUpdates to Push Dridex and Ransomware: Between May and September 2019, researchers at FireEye spotted a campaign bearing similarities to FakeUpdates in that it leveraged compromised web infrastructure to distribute malware such as Dridex and NetSupport. In some cases, these threats then went on to drop BitPaymer or DoppelPaymer ransomware.
  • Attackers Use Fake Office Activation Wizard to Spread Emotet: Bleeping Computer reported that Emotet began using a new template that masquerades as a Microsoft Office Activation Wizard. With that new asset, the campaign attempted to trick users into enabling content so it could use malicious macros and a PowerShell command to load Emotet.
  • Adwind RAT Campaign Going After U.S. Petroleum Companies: In early September, Netskope discovered a new Adwind remote access Trojan (RAT) campaign targeting the petroleum industry in the U.S. This operation leveraged multiple JAR extractions to unpack its payload, which established persistence by creating a registry and used WMI scripts to disable antivirus services.
  • New Reductor Malware Uses Ingenious Method to Mark TLS Traffic: Kaspersky Lab noticed in April 2019 that a new threat called Reductor was infecting popular software distributions and relying on the COMpfun Trojan to make its way onto a host. There, it marked the host’s encrypted Transport Layer Security (TLS) traffic by patching a browser in use by the victim without parsing network packets.
  • FBI Urges Ransomware Victims to Not Pay the Ransom: On Oct. 2, the Federal Bureau of Investigation (FBI) released a public service announcement urging ransomware victims to not pay the ransom, because doing so “emboldens criminals to target other organizations.” The agency told organizations to instead use data backups, centralized patch management systems and other security measures to prevent an infection.
  • Spam Campaign Targets Italian Users With FTCode Ransomware: Since Sept. 26, Bleeping Computer has tracked several media reports surrounding an old PowerShell-based ransomware called FTCode. Those reports revealed that bad actors were using a new spam campaign to infect Italian users with samples of an FTCode variant dating back to 2013.
  • Casbaneiro Targets Banks, Cryptocurrency Services in Latin America: ESET revealed that Casbaneiro malware functions as a typical Latin American Trojan in that it uses fake pop-up windows and backdoor capabilities to target users’ banking information. The security firm also observed the malware hijacking users’ clipboard data to steal their cryptocurrency.

Security Tip of the Week: Create a Comprehensive Vulnerability Management Program

Threat actors such as eGobbler are constantly capitalizing on software vulnerabilities to prey on organizations. That’s why security professionals should turn to connected security solutions that use network topology modeling and security information and event management (SIEM) integration to create a comprehensive vulnerability management program.

Through this framework, researchers should also look for a tool that offers patch posture reporting functionality to confidently defend against security weaknesses.

More from

Cloud Threat Landscape Report: AI-generated attacks low for the cloud

2 min read - For the last couple of years, a lot of attention has been placed on the evolutionary state of artificial intelligence (AI) technology and its impact on cybersecurity. In many industries, the risks associated with AI-generated attacks are still present and concerning, especially with the global average of data breach costs increasing by 10% from last year.However, according to the most recent Cloud Threat Landscape Report released by IBM’s X-Force team, the near-term threat of an AI-generated attack targeting cloud computing…

Testing the limits of generative AI: How red teaming exposes vulnerabilities in AI models

4 min read - With generative artificial intelligence (gen AI) on the frontlines of information security, red teams play an essential role in identifying vulnerabilities that others can overlook.With the average cost of a data breach reaching an all-time high of $4.88 million in 2024, businesses need to know exactly where their vulnerabilities lie. Given the remarkable pace at which they’re adopting gen AI, there’s a good chance that some of those vulnerabilities lie in AI models themselves — or the data used to…

FBI, CISA issue warning for cross Apple-Android texting

3 min read - CISA and the FBI recently released a joint statement that the People's Republic of China (PRC) is targeting commercial telecommunications infrastructure as part of a significant cyber espionage campaign. As a result, the agencies released a joint guide, Enhanced Visibility and Hardening Guidance for Communications Infrastructure, with best practices organizations and agencies should adopt to protect against this espionage threat. According to the statement, PRC-affiliated actors compromised networks at multiple telecommunication companies. They stole customer call records data as well…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today