Exploit Kit Infects 1.3 Million Computers Through Advertisements

The past six weeks have been about 1.3 million Internet users become infected because they are contaminated classifieds websites visited and had not patched their software. That leaves security firm Trustwave know . The ads redirect users to a new version of the RIG 3.0 exploitkit. This exploitkit uses vulnerabilities in Adobe Flash Player and Windows to infect users with malware. Especially vulnerabilities in Flash Player resulted in a lot of infections.

It is in this case for known vulnerabilities for which updates are available. In total, users would through compromised 3.5 million times ads have been forwarded to the exploitkit, resulting to 1.25 million infections. That equates to an average of 27,000 infections each day and a success rate of 34%. In addition, only traffic from Internet Explorer users redirected to the exploitkit.

Traffic originating from other operating systems and browsers is filtered by the cyber criminals. Once infected computers are then equipped with additional malware such as spambots and ransomware. To protect themselves against this type of attack Trustwave recommends users update their software, and specifically their browser and plug-ins. In addition, the use of click-to-play recommended browsers.

Malignant Macro Virus Bypasses Via MHTML Format

Cyber criminals have used a remarkable file to malicious macros invisible for virus scanners, as several researchers have discovered. The use of macros in Office documents has become a popular tactic to spread malware.

Macros are disabled by default in Office, but when users enable the macro can download and install malware. Recently discovered researcher Bart Blaze a spam campaign where there is a doc file with malicious macros added. In reality it turned out to be a Word MHTML file. According to researchers at security firm Trustwave beat the criminals after making the malicious macro as an MHTML file, to which then rename it to .doc or .xls. As a result the file will be opened by Microsoft Office.

When the spam campaign was detected showed that most virus scanners that are not detected. According to investigators, the criminals have malicious macros intentionally saved as MHTML file, to circumvent virus. An analysis of the MHTML file shows that the part of the evil macro via base64 encoded. In case users open the attachment and run the macro is a Trojan horse installed that is specifically designed to steal money from online bank accounts. Users also are advised to Microsoft Office can be configured to all macros are blocked.

Malware Lets Computers See Pro-Russian Videos

Cyber criminals turn into infected computers in order to artificially inflate the number of views of pro-Russian videos on the website Dailymotion, which increases the visibility of the videos in real website visitors. It is more common before infected computers used to visit websites and example to commit or advertising click fraud or to increase the number of views of a video.

Researchers Trustwave first thought that this is also in the now discovered malware campaign was the case, until the contents of the traffic information has been viewed. This was in fact intended for various pro-Russian videos on DailyMotion. The website is according to Alexa on the 84th spot of most visited websites on the internet. The researchers believe that political considerations should play a role.

Users of infected computers were shown the pro-Russian films do not, as they were loaded on a "hidden desktop". The videos, each of which had about 320,000 views, were thus more visible to real visitors from Dailymotion. According to researchers from Trustwave is the first time that this technique is used for a probable political agenda.

JavaScript Annex Spreads CryptoWall-Ransomware

In many email attacks are used executables and Office documents, but there are spammers that use JavaScript attachments. Before warns Trustwave. The security company recently discovered a spam campaign where emails were sent that contain supposedly a resume laity.

There was a zip file as an attachment sent with it a Javascript file, ending .js. Once the recipient opened the file the script tried to download an executable, which turned out to be a variant of the CryptoWall-ransomware. This ransomware encrypts all kinds of files on the computer and then asks hundreds of dollars for decrypting it.

On another spam campaign Trustwave discovered a phishing attack that also made ​​use of JavaScript. In this case, an HTML file was sent to JavaScript which recipients must enter their account details. "If an e-mail telling you to enable JavaScript that you should not really do," says analyst Brian Bebeau. "Despite the use of executable files and other exploits you can not ignore JavaScript attachments in your e-mail traffic. They can both your users and yourself cause problems."

Attack With Malicious Macros In XML Files

Cyber ​​criminals use to spread again some time macros in documents to malware, but now there are also attacks observed with XML files were deployed. Macros allow users to automate various tasks and were used years back on a large scale by malware. Because of the security risks, Microsoft decided therefore to block macros by default in Office.

A year ago, appeared more and more .doc and .xls documents containing macros were hidden. The documents users were summoned to enable macros. Once the user the macro switch is downloaded and installed malware instance in the background. One tactic that seems to be successful, because the beginning of this year, Microsoft already gave a warning off for macro malware. Now warns security firm Trustwave for a new attack in which malicious macros are used via XML files.

XML stands for Extensible Markup Language and XML-based formats have become the standard for various office tools, including Microsoft Office. When a user loads the XML file opens Office and will appear again indicating that macros must be enabled. After switching a malicious script is executed that downloads and installs a Trojan horse. It is the Dridex banking Trojan, malware specifically designed to steal money from online bank accounts. The Internet Storm Center (ISC) gives organizations advice how this kind of XML files can be filtered.