2014

(Year/Month)

Botnets

• Starting in 2014: BandarChor, CTB-Locker, Chthonic, Dyre, FighterPOS, Getmypass, Kjw0rm, Koler, NanoCore, NewPOSThings, OphionLocker, Pitou, Punkey, ScarePakage, Simplocker, Sir DoOom, TorrentLocker, VirLock
• Ending in 2014: Shylock

Publications

	Author	Editor	Botnet	Campaign
"Crypto Ransomware" CTB-Locker (Critroni.A) on the rise	Kafeine	Kafeine	CTB-Locker
A ScarePakage variant is targeting more countries : impersonating Europol and AFP	Kafeine	Kafeine	ScarePakage
An internet census taken by an illegal botnet – A qualitative assessment of published measurements	Thomas Krenc Oliver Hohlfeld Anja Feldmann	SIGCOMM Computer Communication Review	Carna
Analysis of a VBScript bot		Zscaler	Jenxcus
And real name of Magnitude is....	Kafeine	Kafeine
Android RATs branch out with Dendroid	Peter Coogan	Symantec	Dendroid
Andromeda 2.7 features	Suweera De Souza	Fortinet	Andromeda
Anunak:APT against financial institutions	Group-IB Fox-IT	Fox-IT	Carberp Qadars Anunak (botnet)	Anunak
Banking trojan Dridex uses macros for infection	Rhena Inocencio	Trend Micro	Cridex Dridex
Bitcrypt broken	Fabien Perigaud Cédric Pernet	Cassidian Cybersecurity	Bitcrypt
CVE-2013-5330 (Flash) in an unknown Exploit Kit fed by high rank websites	Kafeine	Kafeine	Lurk
Combatting point-of-sale malware		Trustwave
Critroni crypto ransomware seen using Tor for command and control	Dennis Fisher	Kaspersky lab	CTB-Locker
CryptoDefense and How Decrypt ransomware information guide and FAQ	Lawrence Abrams	Bleeping Computer	CryptoDefense
Dragonfly Threat Against Western Energy Suppliers		Symantec	Karagany Havex	Dragonfly
Dridex learns new trick: P2P over HTTP	S21sec Ecrime	S21sec	Dridex
Dyre Banking Trojan	Brett Stone-Gross Pallav Khandhar	DELL SecureWorks	Dyre
ESET analyzes first Android file-encrypting, TOR-enabled ransomware	Robert Lipovsky	ESET	Simplocker
F-Secure has discovered MiniDuke malware samples in the wild	Pierluigi Paganini		MiniDuke
Have we seen the end of the ZeroAccess botnet?	James Wyke	Sophos Labs	ZeroAccess
IcoScript: using webmail to control malware	Paul Rascagnères	Virus Bulletin	IcoScript
Illuminating the Etumbot APT backdoor		Arbor Networks	Etumbot	APT12
Kaptoxa point-of-sale compromise		ISight Partners	Dexter VSkimmer BlackPOS
Kelihos botnet trying to expand by harnessing Russian national sentiments	Ran Mosessco Nick Griffin Brandon Laux	Websense	Kelihos
Lights Out: Dragonfly is on the move	Sariel Moshe	CyActive	Karagany Havex SYSMain	Dragonfly
MSIE 0-day exploit CVE-2014-0322 - Possibly targeting French aerospace association	Alex Watson Victor Chin	Websense
MSRT April 2014 – Ramdo	Shawn Wang	Microsoft	Ramdo Beebone
Malware analysis of the Lurk downloader	Brett Stone-Gross	DELL SecureWorks	Lurk KINS
NetTraveler APT gets a makeover for 10th birthday	Kurt Baumgartner Costin Raiu	Kaspersky lab	NetTraveler
New PoS malware “Backoff” targets US		Trend Micro	Backoff Alina
New crypto-ransomware emerge in the wild	Eduardo Altares II	Trend Micro	CTB-Locker Cryptoblocker
Operation SnowMan: DeputyDog actor compromises US veterans of foreign wars website	Ned Moran Darien Kindlund Dan Caselden Xiaobo Chen Mike Scott	FireEye		SnowMan
Operation Socialist The Inside Story Of How British Spies Hacked Belgium’s Largest Telco	Ryan Gallagher	The Intercept	Regin
OphionLocker: Joining in the Ransomware Race		F-Secure	OphionLocker
Pitou, The “silent” resurrection of the PITOU notorious Srizbi kernel spambot		F-Secure	Pitou Srizbi Turla
PlugX: some uncovered points	Fabien Perigaud	Cassidian Cybersecurity	PlugX
PoS RAM scraper malware; past, present and future	Numaan Huq		Backoff Dexter Alina Rdasrv VSkimmer BlackPOS Decebal JackPOS Soraya ChewBacca BrutPOS
Poison Ivy: assessing damage and extracting intelligence	FireEye	FireEye	Poison Ivy
Pushdo botnet gets DGA update, over 6,000 machines host new variant	Danielle Walker	Haymarket Media, Inc	Cutwail Pushdo
REVETON Ransomware Spreads with Old Tactics, New Infection Method	Alvin Bacani David Sancho Jamz Yaneza	Trend Labs	Reveton
RIG exploit kit strikes oil	Andrew Tsonchev Levi Gundert Emmanuel Tacheau Joel Esler	CISCO	Cryptowall
Sony/Destover: mystery North Korean actor’s destructive and past network activity	Kurt Baumgartner	Kaspersky Securelist	Destover
Symantec/W32.Zorenium	Kevin Savage	Symantec	Zorenium
TR-24 analysis - Destory RAT family		CIRCL	Destory PlugX Sogu Thoper TVT
Targeted attacks and Ukraine	Mikko Hypponen Timo Hirvonen	F-Secure	MiniDuke
The 'Penquin' Turla	Kurt Baumgartner Costin Raiu	Kaspersky Securelist	Turla
The Dark Alleys of Madison Avenue: Understanding Malicious Advertisements	Apostolis Zarras Alexandros Kapravelos Gianluca Stringhini Thorsten Holz Christopher Kruegel Giovanni Vigna	Internet Measurement Conference
The Epic Turla operation	GReAT	Kaspersky lab	Turla	Epic Turla
The Target breach by the numbers	Brian Krebs	Krebs on Security	BlackPOS
The evolution of webinjects	Jean-Ian Boutin	Virus Bulletin	SpyEye ZeuS
... further results