ADB.Miner: More Information
This blog is a joint effort of 360 Beaconlab, 360 CERT, 360 MobileSafe, 360Netlab and 360 Threat Intelligence Center. Overview About 48 hours ago, we reported an Android worm ADB.miner in our previous blog. This malware can replicate itself over Android devices by utilizing the opened ADB debugging interface. The spreading speed is quite fast, doubles about every 12 hours. Over the last 48 hours,
Art of Steal: Satori Variant is Robbing ETH BitCoin by Replacing Wallet Address
Art of Steal: Satori Variant is Robbing ETH BitCoin by Replacing Wallet Address The security community was moving very fast to take actions and sinkhole the Satori botnet C2 after our December 5 blog. The spread of this new botnet has been temporarily halted, but the threat still remains. Starting from 2018-01-08 10:42:06 GMT+8, we noticed that one Satori’s successor variant (we name it Satori.Coi
Early Warning: A New Mirai Variant is Spreading Quickly on Port 23 and 2323
Early Warning: A New Mirai Variant is Spreading Quickly on Port 23 and 2323 [Updates on 2017-11-28] Both C2s have been sink-holed now by security community. admin/CentryL1nk is a typo for admin/CenturyL1nk. About 60 hours ago, since 2017-11-22 11:00, we noticed big upticks on port 2323 and 23 scan traffic, with almost 100k unique scanner IP came from Argentina. After investigation, we are quite co
Http 81 Botnet: the Comparison against MIRAI and New Findings
Overview In our previous blog, we introduced a new IoT botnet spreading over http 81. We will name it in this blog the http81 IoT botnet, while some anti-virus software name it Persirai, and some other name it after MIRAI. In this blog, we will compare http81 against mirai at binary level: 1. Similarities to Mirai 1.1 Same IP Blacklist in Scanning Module 1.2 Same Functions as a Fundamental Library
New Threat Report: A new IoT Botnet is Spreading over HTTP 81 on a Large Scale
New Threat Report: A new IoT Botnet is Spreading over HTTP 81 on a Large Scale Overview 360 Network Security Research Lab recently discovered a new botnet that is scanning the entire Internet on a large scale. Taking into account the following factors in the botnet, we decided to disclose our findings to the secure community: Very active, we can now see ~ 50k live scanner IPs daily. Malicious code
Now Mirai Has DGA Feature Built in
Update History 2016-12-09 first version 2016-12-12 fig-0 update, fix a TLD choosing error in our DGA implement Summary Nearly 2 weeks ago, 2 new infection vectors (aka TCP ports of 7547 and 5555) were found being used to spread MIRAI malwares <A Few Observations of The New Mirai Variant on Port 7547> My colleague Genshen quickly set up some honeypots for that sort of vectors and soon had his harve
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
GPON Exploit in the Wild (II) - Satori Botnet
Memcache DDoS: A Little Bit More
DDG: A Mining Botnet Aiming at Database Servers
360 Netlab Blog - Network Security Research Lab at 360
IoT_reaper: A Few Updates
Is Hajime botnet dead?
New Mirai DGA Seed 0x91 Brute Forced