Eric.freyssinet: Text replacement - " f-secure.com" to ""

2015-08-05T20:52:12Z

Text replacement - " f-secure.com" to ""

← Older revision		Revision as of 20:52, 5 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.f-secure.com/weblog/archives/00002334.html ~~f-secure.com~~		\|Link=http://www.f-secure.com/weblog/archives/00002334.html
	\|Author=,		\|Author=,
	\|NomRevue=F-Secure weblog		\|NomRevue=F-Secure weblog

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:55Z

1 revision imported

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.f-secure.com/weblog/archives/00002334.html f-secure.com
|Author=,
|NomRevue=F-Secure weblog
|Date=March 30 2012
|Editor=F-Secure
|Year=2012
|ISBN=
|Page=
|Abstract=A new Mac backdoor exploiting CVE-2011-3544 (a Java vulnerability) is being reported. The backdoor appears to be connected to GhostNet. The malware is being used in targeted attacks against non-governmental organizations (NGO).

Greg Walton published details of targeted mails sent to NGOs related to Tibet. The message contains a link to: dns.assyra.com. Read more from Walton here. AlienVault Labs has posted a technical report.

Based on today's news, Brod, one of our Mac malware analysts, remembered this post by Microsoft: Backdoor Olyx – is it malware on a mission for Mac? The post is about a similarly themed attack targeting both Mac and Windows users last July.

We detect these new threats as:

Exploit:Java/CVE-2011-3544.E — MD5: 6C8F0C055431808C1DF746F9D4BB8CB5, MD5: 453A3DC32E2FAFD39F837A1EBE62CA80
Backdoor:OSX/Olyx.B — MD5: 39084b60790ca3fdebe1cd93a4764819
Backdoor:W32/Poison.CE — MD5: 7F7CBC62C56AEC9CB351B6C1B1926265

See yesterday's Mac related post for Java mitigation tips.
|Botnet=Ghostnet,
|Malware=Olyx.B, Poison.CE,
|CCProtocol=,
|Operation=,
|Keyword=,
}}

China targets macs used by NGOs - Revision history

Eric.freyssinet: Text replacement - " f-secure.com" to ""

Eric.freyssinet: 1 revision imported