Brazilian govt sites found serving malware
Posted on 28.05.2013
Cyber crooks targeting Brazilian users have a well-documented predilection for banking Trojans, but every now and then they opt for other types of malware.

Trend Micro researchers have recently discovered that two Brazilian government websites have been compromised and have been serving a number of malware variants to visitors since late last week.

Masquerading as "Adobe" and Flash Player updates and upgrades, the malicious executables usually drops another executable and a Java file posing as a .GIF file.

While the first lowers the systemís security settings, the second one downloads and executes additional files, and among them is a .JAR file that creates a new administrator account through which multiple concurrent remote desktop sessions in the affected computer are enabled, giving remote attackers complete control over the computer.

What is the ultimate goal of this attack is unknown, and it could theoretically be anything.

The researchers haven't mentioned which particular government sites were compromised, but this could be a watering hole campaign aimed to compromise computers belonging to government workers, or it could be a simple information-stealing campaign aimed at random users.









Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 29th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //