Brazilian govt sites found serving malware
Posted on 28.05.2013
Cyber crooks targeting Brazilian users have a well-documented predilection for banking Trojans, but every now and then they opt for other types of malware.

Trend Micro researchers have recently discovered that two Brazilian government websites have been compromised and have been serving a number of malware variants to visitors since late last week.

Masquerading as "Adobe" and Flash Player updates and upgrades, the malicious executables usually drops another executable and a Java file posing as a .GIF file.

While the first lowers the system’s security settings, the second one downloads and executes additional files, and among them is a .JAR file that creates a new administrator account through which multiple concurrent remote desktop sessions in the affected computer are enabled, giving remote attackers complete control over the computer.

What is the ultimate goal of this attack is unknown, and it could theoretically be anything.

The researchers haven't mentioned which particular government sites were compromised, but this could be a watering hole campaign aimed to compromise computers belonging to government workers, or it could be a simple information-stealing campaign aimed at random users.









Spotlight

Proactive real-time security intelligence: Moving beyond conventional SIEM

Discussions about security intelligence still focus primarily around conventional reactive SIEM. Security pros need to move from this reactive model to proactively using this security intelligence to protect their businesses.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Fri, Aug 28th
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //