Taking Over the Overlay: Reconstructing a Brazilian Remote Access Trojan (RAT)
IBM X-Force researchers detected, reverse engineered, reconstructed and simulated a Delphi-based Brazilian remote access Trojan.
Taking Over the Overlay: What Triggers the AVLay Remote Access Trojan (RAT)?
IBM X-Force researchers discovered, reverse engineered and reconstructed AVLay, a remote access Trojan that mixes DLL hijacking with a legitimate executable borrowed from various antivirus programs.
Taking Over the Overlay: Reverse Engineering a Brazilian Remote Access Trojan (RAT)
X-Force researchers discovered a new remote access Trojan variant that mixes Dynamic Link Library (DLL) hijacking with a legitimate executable borrowed from various antivirus programs.
Web Servers Used to Host 10 Malware Families Distributed via Phishing Emails
Digital attackers used more than a dozen web servers to host 10 malware families and distributed those threats using phishing emails.
IcedID Banking Trojan Spruces Up Injection Tactics to Add Stealth
IBM X-Force analyzed modifications made to IcedID that help the banking Trojan act more stealthily on infected devices.
The Business of Organized Cybercrime: Rising Intergang Collaboration in 2018
In 2018, IBM X-Force researchers observed organized cybercrime groups collaborating, rather than competing over turf or even attacking each other, for the first time.
Threat Actor Targets Japanese Users With New Ursnif Variant
Security researchers discovered an attack campaign targeting Japanese users with a new variant of Ursnif banking malware.
IcedID Operators Using ATSEngine Injection Panel to Hit E-Commerce Sites
The X-Force research team investigated the IcedID Trojan's two-step injection attack that enables it to steal access credentials and payment card data from e-commerce customers in North America.
Ursnif, Emotet, Dridex and BitPaymer Malware Families Team Up to Wreak Havoc
Researchers discovered a link between four malware families — Ursnif, Emotet, Dridex and BitPaymer — that suggests threat actors may be combining efforts to develop more sophisticated attack vectors.
LCG Kit Document Builder Now Using Microsoft Word Macros to Install Malware Payloads
A weaponized document builder service known as LCG Kit added the ability to use Microsoft Word macros to load the necessary shellcode for installing malware.