Blog

Malware

CVE-2020-0796 – A “wormable” Remote Code Execution vulnerability in SMB v3

 March 13, 2020

Estimated reading time: 2 minutes

Since last two days, the Internet is rife with news around a critical remote code execution vulnerability in SMBv3.1.1 compression mechanism. Today, on 12th March 2020 Microsoft has released an emergency out-of-band patch to address this vulnerability. As per Microsoft release information, it’s a remote code execution vulnerability in the...

HorseDeal Riding on The Curveball!

 February 5, 2020

Estimated reading time: 5 minutes

It’s surprising to see how quickly attackers make use of new vulnerabilities in malware campaigns. Microsoft recently patched a very interesting vulnerability in their monthly Patch Tuesday update for January 2020. It’s a spoofing vulnerability in Windows CryptoAPI (Crypt32.dll) validation mechanism for Elliptic Curve Cryptography (ECC) certificates. An attacker could...

A sloppy click can exfiltrate your important data!

 February 3, 2020

Estimated reading time: 4 minutes

Phishing email still remains one of the top malware propagation medium. Recently, we came across an interesting phishing email containing couple of Jumpshare links pointing to malicious components. Jumpshare is an online file sharing service and often cyber criminals abuse these kind of file sharing services. Upon clicking on one of the links in...

New wave of Mal-Spam campaign attaching Disk Imaging Files

 January 24, 2020

Estimated reading time: 6 minutes

From past few months at Quick-Heal Labs, we have been observing a sudden rise in Spear Phishing mail containing distinct file formats as attachment like IMG, ISO, etc. These new types of attachments are mainly used to deploy some well-known and older Remote Access Trojans. The subject of these emails...

Ako Ransomware targeting businesses using RaaS

 January 24, 2020

Estimated reading time: 5 minutes

Ako Ransomware targeting businesses using RaaS Quick Heal security researchers recently observed ransomware that uses RaaS (Ransomware as a Service) which is a subpart of MaaS (Malware as a Service). Before delving into the AKO ransomware or RaaS, one must understand what Malware as a Service means, as it is...

STOP (Djvu) Ransomware: Ransom For Your Shady Habits!

 January 15, 2020

Estimated reading time: 9 minutes

With almost 200 extensions, STOP (djvu) ransomware can be said to be 2019’s most active and widespread ransomware. Although this ransomware was active a year before, it started its campaign aggressively in early 2019. To evade detection, it has been continuously changing its extensions and payloads. For earlier infections, data...

KKNPP Attack: Tracking the DTrack!

 November 4, 2019

Estimated reading time: 2 minutes

The recent cyber-attack on Kudankulam Nuclear Power Plant (KKNPP) has been confirmed by the officials and yet again security of critical infrastructure has become the talk of the cyber world. The officials mentioned that there is no damage to control systems of the plant as the core processing controls are...

The infamous Spyware – Pegasus, The NSO Group and The WhatsApp snooping saga

 November 2, 2019

Estimated reading time: 2 minutes

The Indian media is abuzz these days with several news and allegations around snooping on several Indian citizens through a spyware named Pegasus, allegedly delivered through WhatsApp. It’s reported widely that Facebook Inc., the parent company of popular messaging app -WhatsApp, reached out to few users from India (and other...

Quick Heal reports 29 malicious apps with 10 million+ downloads on Google Play Store

 September 24, 2019

Estimated reading time: 5 minutes

Quick Heal Security Labs reported 29 malicious apps found on Google Play Store, which have a collective download count of more than 10 Millions. Google was quick enough to remove these malicious apps from Play Store immediately. One of the Apps from this set, named “Multiapp multiple accounts simultaneously” has crossed 5 million...

The Free Mobile Anti-virus you are using can be a Fake!

 September 9, 2019

Estimated reading time: 4 minutes

Quick Heal Security Labs recently spotted multiple Fake Antivirus Apps on Google Play Store. What’s more alarming, is that one of these fake AV Apps has been downloaded 100000+ times already. These Apps appear to be genuine Anti-virus/virus-removal Apps with names like Virus Cleaner, Antivirus security, etc., but do not...