Prometei botnet and its quest for Monero
Attackers are constantly reinventing ways of monetizing their tools. Cisco Talos recently discovered a complex campaign employing a multi-modular botnet with multiple ways to spread and a payload focused on providing financial benefits for the attacker by mining the Monero online currency. The actor employs various methods to spread across the network, like SMB with […]
Breaking down a two-year run of Vivin’s cryptominers
News Summary There is another large-scale cryptomining attack from an actor we are tracking as “Vivin” that has been active since at least November 2017. “Vivin” has consistently evolved over the past few years, despite having poor operational security and exposing key details of their campaign. By Andrew Windsor. Talos has identified a new threat […]
Hunting For LolBins
Attackers’ trends tend to come and go. But one popular technique we’re seeing at this time is the use of living-off-the-land binaries — or “LoLBins”. LoLBins are used by different actors combined with fileless malware and legitimate cloud services to improve chances of staying undetected within an organisation, usually during post-exploitation attack phases. Living-off-the-land tactics […]
Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”
A new threat actor named “Panda” has generated thousands of dollars worth of the Monero cryptocurrency through the use of remote access tools (RATs) and illicit cryptocurrency-mining malware.
RATs and stealers rush through “Heaven’s Gate” with new loader
Malware is constantly finding new ways to avoid detection. This doesn't mean that some will never be detected, but it does allow adversaries to increase the period of time between...
Cisco Encrypted Traffic Analytics: Necessity Driving Ubiquity
Cisco's Encrypted Traffic Analytics (ETA) ensures the privacy of our most important business data and allowing us to detect malware that uses that same privacy to cover its tracks.
Black Hat Asia 2019: Watch Out for the Secondary Payload
Cisco Security was a proud technology partner in the Network Operations Center (NOC) at Black Hat Asia, providing secure and open Internet access to attendees. See what the NOC discovered.
Cisco Security at Work: Threatwall at Mobile World Congress 2019
The Threatwall is a live display of threats on open conference wireless networks wherever it is deployed, such as Cisco Live or WMC, providing valuable insights on network traffic trends.
Malicious Cryptomining is Exploding. Are you at risk?
With a 19x increase in crypto related traffic in the last nine months, it's time to find out if computing resources in your organization are being used without your knowledge.