Joao Malware Analysis
August 31, 2017
Overview Security researchers from the security firm ESET spotted a piece of malware dubbed Joao targeting gamers. This malware is found inside an Aeria game installation pack provided by a third party. Upon the start of a game, this malware runs in the background, sending the victim’s machine information to the attacker, including the operating […]
Moyou Trojan Analysis
August 31, 2017
Overview On August 2, 2017, ANTIY discovered a new DDoS trojan and dubbed it Moyou. After obtaining the related sample, NSFOCUS conducted a detailed analysis of the trojan. Sample Analysis The following figure shows the detection result of NSFOCUS Threat Analysis Center (TAC). The sample obtains the C&C server address (www.linux288.com) by reading data from […]
H1 2017 Cybersecurity Insights
August 29, 2017
Overview This year a significant amount of security events such as WannaCry, Petya, and NotPetya occurred adversely affecting a wide variety of social and economic activities. To mitigate threats brought by such events IT and security teams have spared no effort in combating against such attacks for the security and protection of their organizations. It […]
NSFOCUS solutions now available in AliCloud Marketplace
August 22, 2017
AliCloud offers first ICSA and Veracode certified Web Application Firewall powered by NSFOCUS to secure more than 2 million customers SINGAPORE, August 22, 2017 – NSFOCUS, the leader in holistic hybrid security solutions, is now offering its comprehensive Web Application Security solution on Alibaba Cloud (AliCloud) to ensure enterprises are equipped with the most comprehensive […]
Remote Access Trojan KONNI Targeting North Korea Technical Analysis and Solution
August 18, 2017
This July a remote access trojan (RAT) KONNI was discovered to be involved in a cyberattack targeting North Korea, which was presumably linked to South Korea. This RAT spreads mainly through phishing emails. Specifically, the attacker first tries to have a powershell script executed via an .scr file, and then downloads the malware of an […]
Dumbo Exploit Project
August 4, 2017
Overview This week WikiLeaks published a document outlining another leaked hacking tool developed by the CIA (Central Intelligence Agency). The exploit titled ‘Dumbo’ possesses the capability of remotely managing and altering video and audio recordings on Windows XP systems. At the moment, the malware is only able to successfully run on 32-bit Windows XP, Vista, […]
