Tag Archive for: Biting

Snake malware biting hard on 50 apps for only $25


snake

Cybercriminals are flooding to use the Snake password-stealing trojan, making it one of the popular malware families used in attacks.

Snake has been active since November 2020 and is a different project from the ransomware operation that used the same name in the past.

Written in .NET and using the same staging mechanism as FormBook and Agent Tesla, researchers from Cybereason take a deep dive into how the rising threat operates.

Wide range of malicious features

Cybercriminals currently sell Snake on dark web forums for as low as $25, which could be why we see a spike in its deployment.

Mainly deployed in phishing campaigns, Snake installed via malicious email attachments or through drops sites reached by clicking on email links.

When installed on a computer, Snake is capable of stealing credentials from over 50 apps, including email clients, web browsers, and IM platforms.

Some of the more popular programs targeted by Snake include:

  • Discord
  • Pidgin
  • FileZilla
  • Thunderbird
  • Outlook
  • Brave browser
  • Chrome
  • Edge
  • Firefox
  • Opera
  • Vivaldi
  • Yandex

Snake also features keystroke logging, clipboard data theft capabilities and can even capture screenshots of the entire screen, which are then uploaded back to the threat actor.

Snake's stealing capability diagram
Snake’s stealing capability diagram
Source: Cybereason

 

Other features include stealing OS data, memory space info, geolocation, date-time information, IP addresses, and more.

A previous analysis from HP has shown that threat actors may use the geolocation data to restrict installation based on the victim’s country.

All in all, it’s a versatile info-stealer for its cost and has been successful at hiding from security solutions.

Evading detection

To avoid detection, Snake disables AV defenses by killing the associated processes and goes as far as to disable network traffic analyzers such as Wireshark.

Snake then adds itself to the exclusion list of the Windows Defender, allowing it to execute malicious PowerShell commands without being detected.

Snake adds a scheduled task and edits a registry key to execute when a user logs in to Windows to establish persistence.

Finally, it is noteworthy that Snake gives its operators the versatility to choose what features they will…

Source…

Biting into Apple – The Economist (blog)


CNNMoney

Biting into Apple
The Economist (blog)
Steven Bellovin, a long-time internet security researcher and a recent one-year appointee as chief technologist of the Federal Trade Commission, notes in a blog that he finds the error "too visible and too clumsy" to be that of a national-security
iPhone And iPad Users Hit By Security GlitchSky News
Apple Release Patch To Address Security RiskThe News Reports
Mac users warned against using public Wi-Fi networksCSO Magazine

all 754 news articles »

“internet security” – read more