Security Affairs
JULY 23, 2024
Attackers used this swap file to keep malware on the server and evade detection. After removing the swap file and clearing caches, the checkout page was clean. “The swapme part of the file name clued us in that there might be some swap lingering around. ” reads the report published by Sucuri.
Security Affairs
FEBRUARY 16, 2024
Threat actors compromised the websites running vulnerable versions of the popular CMS, including 4.4.20, 5.0.21, 5.1.18 The attackers uploaded PHP files containing the C2 code consisting of names such as: rss-old[.]php, killme” : Create a BAT file (see below) with a name based on the current tick count.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Security Affairs
APRIL 2, 2019
of the popular CMS that are affected by a cross-site request forgery (CSRF) flaw that resides in the comment section of WordPress that is enabled by defaul t. According to the experts, the cybercriminals targeted websites running outdated CMS plugins and themes or server-side software. zip) that contain the JavaScript file.
Security Affairs
MARCH 1, 2021
. “And if that same site visitor clicks the “direct download link” provided on this page, they receive a.zip archive file with a filename that exactly matches the search query terms used in the initial search, which itself contains another file named in precisely the same way.” ” continues the analysis.
Security Affairs
MARCH 28, 2022
The phishing messages use a RAR-archive named “Saboteurs.rar”, which contains RAR-archive “Saboteurs 21.03.rar.” ” This second archive contains SFX-archive “Saboteurs filercs.rar,” experts reported that the file name contains the right-to-left override (RTLO) character to mask the real extension.
Security Affairs
DECEMBER 17, 2019
The name Dacls comes from its file name and the hard-coded strings, the malware has a modular structure that could extend its capabilities by loading plugins. The command and control protocol uses TLS and RC4 double-layer encryption, Dacls uses AES to encrypt configuration file and supports C2 instruction dynamic update.
Security Affairs
FEBRUARY 19, 2019
The phishing email contains a.zip file named “slavneft.zakaz.zip”, which means something like “slavneft order” in English, showing a direct reference to “Slavneft”. It contains a russian speaking JavaScript file named “«??? «??? «?????????» ??????????? ??????”,
Expert insights. Personalized for you.
331 
Let's personalize your content