2013

(Year/Month)

Botnets

• Starting in 2013: Atrax, Avatar, Gamker, MiniDuke, Njw0rm, Obad, Raxm, Vernot
• Ending in 2013: Rocra, Skynet

Publications

	Author	Editor	Botnet	Campaign
"NetTraveler is Running!" - Red Star APT attacks compromise high-profile victims	GReAT	Kaspersky lab	NetTraveler	Red Star
"njRAT" Uncovered	Fidelis	Fidelis cybersecurity	NjRAT
APT1: technical backstage	Malware.lu Paul Rascagnères	Malware.lu	FakeM Poison Ivy	APT1
Adobe Flash Player 0-day and HackingTeam's Remote Control System	Sergey Golovanov	Kaspersky lab
Alina: casting a shadow on POS	Josh Grunzweig	Trustwave	Alina VSkimmer BlackPOS
Alina: following the shadow part 1	Josh Grunzweig	Trustwave	Alina
Alina: following the shadow part 2	Josh Grunzweig	Trustwave	Alina
An encounter with trojan Nap	Ali Islam Abhishek Singh	FireEye	Kelihos
An overview of messaging botnets	François Paget	McAfee	Cutwail Bagle Bobax Kraken Pushdo Donbot Festi Fivetoone Grum Kelihos Lethic Maazben Rustock Waledac Slenfbot Darkmailer
Analyse of the sample cdorked.A	Jvoisin	Malware.lu
Analysis of a PlugX malware variant used for targeted attacks	CIRCL	CIRCL	PlugX
Analysis of a stage 3 Miniduke malware sample		CIRCL	MiniDuke
Analysis of the malware of Red October - Part 1	RootBSD Malware.lu	Malware.lu	Rocra	Red October
Analysis of the malware of Red October - Part 2	RootBSD Malware.lu	Malware.lu	Rocra	Red October
Apache binary backdoors on Cpanel-based servers	Daniel Cid	Sucuri
Attention! All data on your hardrive is encrypted	Tomas Prochazka Michal Cebak	AVG	Rannoh
Avatar rootkit: the continuing saga	Aleksandr Matrosov Eugene Rodionov Anton Cherepanov	ESET Welivesecurity	Avatar
Backdoor uses Evernote as command and control server	Nikko Tamaña	Trend Micro	Vernot
Black Dragon: "... and all will burn beneath the shadow of my wings"	Malwageddon	Malwageddon
Blackhole and Cool Exploit kits nearly extinct	Dennis Fisher	Threatpost	Cutwail Reveton	/closest/
Bot herders build newer versions of previous botnet Waledac		SPAMfighter	Virut Waledac
CVE-2013-1493 (jre17u15 - jre16u41) integrating exploit kits	Kafeine	Kafeine	Urausy
CVE-2013-2465/CVE-2013-2471/CVE-2013-2463 integrating Exploit Kits -- jre7u21 CVE- jre6u45 and earlier	Kafeine	Malware don't need cofee
Carberp-based trojan attacking SAP	Geoff McDonald	Microsoft Malware Protection Centre	Carberp Gamker
Chameleon botnet grabbed $6m A MONTH from online ad-slingers	John Leyden		Chameleon
Citadel plitfi botnet report		CERT Polska	Citadel
Collateral damage: Microsoft hits security researchers along with Citadel		Abuse.ch	Citadel
Cross-platform Frutas RAT builder and back door	Joseph Bingham	Symantec	Frutas
Demystifying Pobelka	Michael Sandee	Fox-IT	SpyEye Citadel Pobelka
Department of Labor strategic web compromise	Matt Dahl	Crowdstrike	Poison Ivy
Detecting extended attributes (ZeroAccess) and other Frankenstein’s monsters with HMFT		Hexacorn	ZeroAccess
Discovered: botnet costing display advertisers over six million dollars per month		Spider.io	Chameleon
File infector Expiro hits US, steals FTP credentials	Rhena Inocencio	Trend Micro	Expiro
First widespread virus cross-infection	Jeet Morparia	Symantec	Expiro
Five charged in largest hacking scheme ever prosecuted in US	Ryan Naraine	SecurityWeek
Going solo: self-propagating ZBOT malware spotted	Abigail Pichel Joie Salvio Alvin Bacani	Trend Micro	ZeuS
Got malware? Rent an exploit service	Kevin Stevens	Damballa
Hello Neutrino ! (just one more Exploit Kit)	Kafeine	Kafeine
Hesperbot – A new, advanced banking trojan in the wild	Robert Lipovsky Anton Cherepanov	ESET	Hesperbot
Hiding in plain sight: the FAKEM remote access trojan	Nart Villeneuve	Trend Micro	FakeM
Infamous Skynet botnet author allegedly arrested	MalwareTech	MalwareTech	Skynet
Inside the world of the Citadel trojan	Ryan Sherstobitoff	McAfee	Citadel
Internet Census 2012, port scanning /0 using insecure embedded devices	Carna Botnet		Carna
Kelihos botnet appears again with new variant	Jay Pfoutz	Secure Connexion	Kelihos
Kelihos is dead… No wait… Long live Kelihos! Again!	Phil Hay	Trustwave	Kelihos
Kore exploit kit	Darryl	Kahu Security
Latest Kelihos botnet shut down live at RSA Conference 2013	Michael Mimoso	Kaspersky lab	Kelihos
Lifting the lid on the Redkit exploit kit (Part 1)	Fraser Howard	Sophos Labs
Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole	Pierre-Marc Bureau	ESET
Look what I found: it's a Pony!	Anat Davidi	Trustwave	Pony
... further results