NanoCore RAT Creator Arrested Gets 33 months in Prison

Taylor Huddleston, 26, of Hot Springs, Arkansas, pleaded guilty in July 2017 to one charge of aiding and abetting computer intrusions by building and intentionally selling a remote access trojan (RAT), called NanoCore, to hackers for $25.

Selling a remote access trojan that helped cyber criminals—has finally been sentenced to serve almost three years in prison.

Huddleston was arrested in March, almost two months before the FBI raided his house in Hot Springs, Arkansas and left with his computers after 90 minutes, only to return eight weeks later with handcuffs. 

This case is a rare example of the US Department of Justice (DOJ) charging someone not for actively using malware to hack victims' computers, but for developing and selling it to other cybercriminals.
Huddleston admitted to the court that he created his software knowing it would be used by other cybercriminals to break the law.
He initially started developing NanoCore in late 2012 with a motive to offer a low-budget remote management software for schools, IT-conscious businesses, and parents who desired to monitor their children's activities on the web. 

Huddleston marketed and sold the NanoCore RAT for $25 in underground hacking forums that were extremely popular with cybercriminals around the world from January 2014 to February 2016. He then sold ownership of NanoCore to a third-party in 2016.

NanoCore RAT happens to be popular among cybercriminals on underground hacking forums and has been linked to intrusions in at least ten countries. Among the victims was a high-profile assault on Middle Eastern energy firms in 2015.

Huddleston also agreed with prosecutors that NanoCore RAT and available third-party plugins offered a full set of features including:

• Stealing sensitive information from victim computers, such as passwords, emails, and instant messages.
• Remotely activating and controlling connected webcams on the victims' computers in order to spy on them.
• Ability to view, delete, and download files.
• Locking infected PCs and holding them to ransom.
• Using infected PCs to launch distributed denial of service (DDoS) attacks on websites and similar services.

In July plea, Huddleston also took responsibility for creating and operating a software licensing system called "Net Seal" that was used by another suspect, Zachary Shames, to sell thousands of copies of Limitless keylogger.

Shames used Net Seal to infect 3,000 people that were, in turn, used it to infect 16,000 computers, according to the DoJ.

In his guilty plea, Huddleston admitted that he intended his products to be used maliciously.

Besides the 33-month prison sentence handed down by judges on Friday, Huddleston also gets two years of supervised release.

 You can download crack version --- here.


 

Read More

WannaCry 2.0 is out and No "Kill Switch" Patch Your System Now!

It's not over yet! WannaCry 2.0 is out and No "Kill Switch" 

WannaCry has already infected over 200,000 computers across 99 countries worldwide only in past two days. 

If you are thinking that activating the kill switch has completely stopped the infection, then you are mistaken, because as soon as the attackers realize, they came back.

For those unaware, WannaCry is an insanely fast-spreading ransomware malware that leverages a Windows SMB exploit to target a computer running on unpatched or unsupported versions of Windows and servers and then spread itself like a worm to infect other vulnerable systems in the internal network.

The SMB vulnerability has been identified as EternalBlue, a collection of hacking tools allegedly created by the NSA and then subsequently dumped by a hacking group calling itself "The Shadow Brokers" over a month ago.



Costin Raiu, the director of global research and analysis team at Kaspersky Labs has confirmed the arrival of WannaCry 2.0 variants without kill-switch function.

    "I can confirm we've had versions without the kill switch domain connect since yesterday," Raiu told Motherboard.

So, expect a new wave of ransomware attack, with an updated WannaCry variant, which would be difficult to stop, until and unless all vulnerable systems get patched.

    "The next attacks are inevitable, you can simply patch the existing samples with a hex editor and it'll continue to spread. We will see a number of variants of this attack over the coming weeks and months so it's important to patch hosts." Matthew Hickey, a security expert and co-founder of Hacker House

Instead of depending upon mass email spamming, just like an ordinary malware campaign, WannaCry cyber attack leverages SMB exploit to remotely hijack vulnerable computers just by scanning every IP address on the Internet. 

Even after WannaCry made headlines all over the Internet and media, there are still hundreds of thousands of unpatched systems easily available open to the Internet.

As we notified today, Microsoft took an unusual step to protect its customers with an unsupported version of Windows — including Windows XP, Vista, Windows 8, Server 2003 and 2008 — by releasing security patches that fix SMB flaw currently being exploited by the WannaCry ransomware.

For Windows 7  click HERE.

So, users and organizations are strongly advised to install available Windows patches as soon as possible, and also consider disabling SMBv1.

Additional: How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server, follow step click HERE.

DOWNLOAD MS SECURITY PATCH HERE

Read More

Ransomware based on leaked NSA tools spreads to dozens of countries in the last 24 hours

WannaCry Ransomware That's Hitting World Right Now

A ransomware attack seemingly based on leaked NSA hacking tools is spreading like wildfire among unpatched Windows systems worldwide. Early reports suggested it was targeted at the UK’s National Health Service, but it’s clear now that the attack is a global one, with thousands of computers apparently affected in Russia alone.

A Kaspersky lab analysis puts the number of infected computers at more than 45,000 as of early Friday afternoon, the vast majority of which are Russian (Ukraine, India, Taiwan and Philippines follow). The ransomware’s code makes it pretty clear that it’s taking advantage of an exploit called EternalBlue, published in April by the Shadow Brokers but patched preemptively by Microsoft in March.

If everyone just kept their boxes up to date we wouldn’t have the current viral conflagration, of course, but as usual that’s too much to ask.

A bitcoin wallet reportedly used by the ransomers shows numerous incoming transactions of between 0.15 and 0.3 BTC, worth around $250-$500 today, so at least a few of those infected have opted to pay rather than attempt to extricate their data safely or do a full wipe and rollback.

Microsoft released a patch for the vulnerability in March (MS17-010), but many users and organizations who did not patch their systems are open to attacks. (specially pirated ones)

On Good Friday, the Shadow Brokers released a massive trove of Windows hacking tools allegedly stolen from NSA that works against almost all versions of Windows, from Windows 2000 and XP to Windows 7 and 8, and their server-side variants such as Server 2000, 2003, 2008, 2008 R2 and 2012, except Windows 10 and Windows Server 2016.


The exploit has the capability to penetrate into machines running unpatched version of Windows XP through 2008 R2 by exploiting flaws in Microsoft Windows SMB Server. This is why WannaCry campaign is spreading at an astonishing pace.

Once a single computer in your organization is hit by the WannaCry ransomware, the worm looks for other vulnerable computers and infects them as well. I suggest unplug the LAN of the infected computer so I won't spread on other network computers 

In addition some say they crack the malware with password "WNcry@2o17",  if you encounter this ramsomware try the crack password for WannaCry  "WNcry@2o17" without quote.

Read More

Beware of ongoing Facebook spam campaign is spreading Malware and Ransomware

An ongoing Facebook spam campaign is spreading malware downloader among Facebook users by taking advantage of innocent-looking SVG image file to infect computers.

If clicked, the file would eventually infect your PC with the nasty Locky Ransomware, a family of malware that has quickly become one of the favorite tools among criminals due to its infecting capabilities.

Discovered by malware researcher Bart Blaze, the attack campaign uses Facebook Messenger to spread a malware downloader called Nemucod that takes the form of .SVG image files.

Why SVG file? Hackers considered SVG (or Scalable Vector Graphics) files for spreading the malware downloader, because SVG has the ability to contain embedded content such as JavaScript, and can be opened in a modern web browser.

Crooks added their malicious JavaScript code right inside the image file itself, which was actually a link to an external file.

If clicked, the malicious image file would redirect you to a website mimicking YouTube, but with completely different URL.

Like a typical way to deliver malware infection, the site would push a popup, asking you to download and install a certain codec extension in Google Chrome in order to view the video. The malicious extension used two names, Ubo and One.

Once installed, the extension gives the attackers ability to alter your data regarding websites they visit, as well as takes advantage of browser's access to your Facebook account in order to secretly message all your Facebook friends with the same SVG image file.

That the SVG image file containing the Nemucod downloader, in some cases, then ultimately downloads a copy of Locky ransomware on victim's PC.

Locky ransomware is one of the most popular ransomware that locks all files on a victim's computer with RSA-2048 and AES-1024 encryption algorithms and unlocks them until the ransom is paid to attackers.

If you are one of those who had been tricked into installing one of the two malicious extensions, you can remove it immediately.
To remove the offending extension, just go to Menu → More Tools → Extensions and check for the extension and remove it.

Read More

Beware "Ransomware" has been floating around in the Internet

A ransomware has been floating around for about a week, a type of malicious software designed to block access to a computer system until a sum of money is paid.


    "although ransomware is usually aimed at individuals, it's only a matter of time before business is targeted as well"

Cerber is a ransomware-type malware that infiltrates systems, encrypting various file types including .jpg, .doc, .raw, .avi, etc. Cerber adds a .cerber (some variants add .cerber2 or .cerber3) extension to each encrypted file. Following successful infiltration, Cerber demands a ransom payment to decrypt these files. It is stated that payment of the ransom must fall within the given time frame (seven days), otherwise the ransom amount will double. 

When infected, a victim's data files will be encrypted using AES encryption and will be told they need to pay a ransom of 1.24 bitcoins or ~500 USD to get their files back. 

Unfortunately, at this point there is no known way to decrypt a victim's encrypted files for free.

When first run, Cerber will check to see if the victim is from a particular country. If the computer appears to be from any of the following countries, it will terminate itself and not encrypt the computer.

Armenia, Azerbaijan, Belarus, Georgia, Kyrgyzstan, Kazakhstan, Moldova, Russia, Turkmenistan, Tajikistan, Ukraine, Uzbekistan and now it also found in Asia including Philippines

If the victim is not from one of the above countries, Cerber will install itself in the %AppData%\{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA}\ folder and name itself after a random Windows executable. For example, when we performed our analysis of the ransomware it named itself autochk.exe. It will then configure Windows to automatically boot into Safe Mode with Networking on the next reboot using the following command:

C:\Windows\System32\bcdedit.exe" /set {current} safeboot network

Cerber will then configure itself itself to start automatically when you login to windows, execute as your screensaver when your computer is idle, and set a task to execute itself once every minute. In this phase, when the ransomware is executed it will show a fake system alert and begin a restart process.

Cerber ransomware distributed via spam e-mail attachments (using infected .WSF and .DOC files) or Cerber ransomware is delivered by a rogue document attached to spam emails. Once users open the document, they are encouraged to enable malicious macros - the ransomware then starts to encrypt victims' data

Here some user who commented and message me and confirmed they have encounter Ransomware, unfortunately I can not help..

You can check some removal guide posted by experts below :

• https://www.pcrisk.com/removal-guides/9842-cerber-ransomware
• http://www.bleepingcomputer.com/news/security/the-cerber-ransomware-not-only-encrypts-your-data-but-also-speaks-to-you/
• http://sensorstechforum.com/remove-cerber-3-ransomware-restore-cerber3-encrypted-files/

Good Luck and Remember DO NOT CLICK any suspicious link or open spam email..

Read More

ESET spotted Malicious fake Pokémon Go apps on Google Play Store

Malicious Pokémon Go apps have even made their ways into the official Google Play Store.

Researchers from popular antivirus firm ESET have spotted at least three fake Pokémon Go apps on the Google Play Store. Of them, the one titled "Pokemon Go Ultimate" posed the biggest threat to Android users.

Pokemon Go Ultimate renames itself  "PI Network" and deliberately locks the screen of the victims’ devices immediately after being installed, rending the devices unusable.
The only ways to get the infected phone unlocked are to remove the device's battery or reboot the device via the Android Device Manager.

Even after restarting the device, the app removes itself from the device's app menu, but still continues to run in the background and silently clicks on porn advertisements in an attempt to generate ad revenue for its creators.
The worse: Researchers say that the malicious app is just one step away from being Ransomware.

Although Google has removed the fake Pokémon GO app, users who had already downloaded the app would need to uninstall PI Network manually through their device's application manager.

The rest of the two fraudulent Pokémon apps produced fake security messages in an attempt to trick users into paying for an antivirus service that actually does not exist.
Currently, all three apps seem to be removed from Google Play, but be on guard: more are likely to show up in the coming days.

So, before head out to catch 'em all, BEWARE!! just make sure you are downloading the legitimate Pokémon Go app. 

Remember to be alert at all times. Stay aware of your surroundings..

Check Here ESET's full advisory and security recommendations.

Read More

A new version of the "FLocker" Ransomware has now the ability to infect and lock down your Smart TVs

After targeting hospitals, universities, and businesses, Ransomware has started popping up on Smart TV screens.

Using multiple devices that run on one platform makes life easier for a lot of people. However, if a malware affects one of these devices, the said malware may eventually affect the others, too. This appears to be the case when we came across an Android mobile lock-screen ransomware, known as “FLocker,” that is capable of locking smart TVs as well.


A new version of the Frantic Locker (better known as FLocker) Ransomware has now the ability to infect and lock down your Smart TV,Smartwatch, Smart fridge, or any Internet-connected smart device until you pay up the ransom.

Researchers at Trend Micro have discovered the updated version of FLocker that is capable of locking Android smartphones as well as Smart TVs.

Originally launched in May 2015, the FLocker ransomware initially targeted Android smartphones with its developers constantly updating the ransomware and adding support for new Android system changes.

Here's what the new version of FLocker does to your Android-powered Smart TVs:

• FLocker locks the device's screen.
• Displays a fake notice from United States Cyber Police or other law enforcement agency, accusing potential victims of crimes they did not commit.
• Demands $200 worth of iTunes gift card as Ransom to unlock the infected TV.
• Trend Micro says the malware is configured to deactivate itself in some regions including Russia, Bulgaria, Hungary, Ukraine, Georgia, Kazakhstan, Azerbaijan, Armenia, and Belarus.

However, if FLocker detects devices outside these countries, the malware will wait for 30 minutes before requesting admin privileges for the device. If the victim rejects the request, FLocker freezes the screen, faking a system update.

"The C&C [command and control] then delivers a new payload misspelled.apk and the ‘ransom’ HTML file with a JavaScript (JS) interface enabled," Trend Micro said. "This HTML page has the ability to initiate the APK installation, take photos of the affected user using the JS interface, and display the photos taken in the ransom page."

Although the new variant of FLocker does not encrypt files on the infected device, it has the capability of stealing data from the device, including contacts, the phone number, device information and location data.
Trend Micro's report does not make it clear that how FLocker infects smart TVs, but it does note that typically ransomware infection arrives via SMSes or malicious links.

Therefore, you should be wary while browsing the Internet, and receiving text messages or emails from unknown sources.

How to Remove FLocker from Your Smart TV?
Moreover, if your Android smart TV gets infected, you should contact the device vendor (phone carrier or TV merchant), or if you are kind of technical, you can remove the ransomware after removing its device admin privileges.

"Users can connect their device with a PC and launch the ADB shell and execute the command 'PM clear %pkg%'," Trend Micro said. "This kills the ransomware process and unlocks the screen. Users can then deactivate the device admin privilege granted to the application and uninstall the app."

For securing mobile devices, we advise installing security software in their smart devices to protect it from malicious apps and threats. Trend Micro Mobile Security and Trend Micro Mobile Security Personal Edition protects users from this ransomware and other related threats. Trend Micro Mobile Security Personal Edition is available on Google Play.
 
This isn't the first time when ransomware has targeted Smart TVs. In the past, it was evident how smart TV got attacked with the ransomware also Internet of Things devices being remotely controlled by the attacker.
 


source: Trend Micro,

Read More