Blogs & Stories

SpiderLabs Blog

Attracting more than a half-million annual readers, this is the security community's go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.

ModSecurity News

Over the past few months, there has been a lot going on with ModSecurity. Our lead developer Felipe "Zimmerle" Costa (@zimmerle) has been working hard to add many improvements to the upcoming versions of ModSecurity and we're both also working to address some of the issues reported by....

Patch Tuesday, April 2019

Along with "Spring Showers" up here in the Northern Hemisphere, April also brings with it Microsoft's Patch Tuesday. This release includes patches for 75 CVEs and Adobe's Flash Update.

Spammed PNG file hides LokiBot

Recently we came across a spam message from our traps that looked truly odd when viewed from our Secure Email Gateway console.

Fake CIA Sextortion Scam Uses SatoshiBox

Another round of sextortion scam emails with a pdf attachment were pushed out recently claiming to be from the Central Intelligence Agency (CIA). What's new in this batch of spams is that this is the first time we have seen the scammers use an online web platform in collecting the ransom.

Attacker Tracking Users Seeking Pakistani Passport

A few days ago we encountered a breach on a Pakistani government site which was compromised to deliver a dangerous payload- the Scanbox Framework. This compromise is exactly the kind of attack we were concerned about when discussing the danger in a previous compromise that we uncovered just a few weeks ago against another government site, at that time the Bangladesh Embassy in Cairo.

BEC Payroll Scam: Your Salary is Mine!

Con men have been exploiting human psychology since the dawn of time. Equipped with the capabilities of the digital age they now have the means to launch voluminous lucrative con schemes at a global scale.

Patch Tuesday, March 2019

his month's Patch Tuesday brings with it four advisories and patches for 64 CVEs including a patch for a zero-day actively exploited in the wild.

QRCode Used in Extortion Spam Campaign

Sextortion is a form of sex-themed exploitation via email where victims are coerced to give money to the scammer. Sextortion campaigns have become a large issue in the last year....

Sheepl 2.0: Automating People for Red and Blue Tradecraft

When I first released Sheepl 0.1 in September 2018 as part of a talk, I wanted to showcase a different approach to user emulation, and the initial idea was well received. Security and IT professionals could see the potential and.....

Detecting Malicious Behavior by Unmasking WebSockets

WebSockets allow a single TCP connection to have full duplexing communications.  This type of connection reduces the overhead of HTTP polling, where the client would have to constantly request information from the server in order to get updates.....

Bangladesh Embassy Website in Cairo Compromised

In the world of Phishing emails, we often see schemes which involve enticing users to open a malicious document, sometimes disguised as a form of some sort. In the world of web attacks, we see less of these, as it usually takes a lot more to convince a user casually browsing the internet to download and open a document. But what if the user is visiting a government site where forms are generally in abundance? It looks like this time attackers decided to try their luck and find out.

Digging Deep Into Magecart Malware

Last week, one of my SpiderLabs colleagues was working on a PCI forensic triage for a website. During his investigation, he asked me to check out some HTTP traffic he captured during an online retail store checkout session.

Patch Tuesday, February 2019

With today's Patch Tuesday for February, things are back to normal with patches for 76 CVEs and four advisories. Twenty of the CVEs are rated "Critical," 53 are rated "Important," and three are rated "Moderate."

Money Laundering: Washing Your Greens in the Underground

In the first two parts of our investigative series into the cybercriminal underground, we examined its social structure as well as the types of jobs and opportunities that exist for those with ill intent. We have learned that the dark web’s ecosystem is vast and well-coordinated, with a low barrier to entry due to widely available hacking and malware distribution tools for those with limited technical knowledge. But a life of digital crime by its very nature leaves a long trail for investigators – so what happens once a cybercriminal succeeds in their nefarious schemes and turns a profit?

Sextortion Scam Now With Malicious Downloader

Sextortion scams were a hit campaign last year and are continuing in  2019 with a new trick – the inclusion of an archive attachment which contains a malicious JavaScript downloader as “proof”.

Latest Flash 0-Day (CVE-2018-15982) Leaves its Office Doc Friend Behind

CVE-2018-15982 is the Flash 0day that was patched by Adobe at the beginning of December. At the time it was used by an APT group with the delivery mechanism being an Office document with the malicious Flash file residing inside, Qihoo360 published a good analysis of this attack...

Living off the LAN

When an attacker uses tools native to the operating system it is referred to as Living off the Land. Personally, I think it should be called Living off the LAN because it’s a techy play on the acronym for Local Area Network. This blog post will cover Living off the Land activity associated with Carbanak/FIN7 that Trustwave SpiderLabs encountered during a recent investigation. The post will include:

Stay Connected


Subscribe

Sign up to receive the latest security news and trends from Trustwave.

No spam, unsubscribe at any time.


Trending Topics