ESET Threat Blog

Aleksandr Matrosov, one of my colleagues in Moscow, writes:
This month we discovered some new facts relating to Win32/Carberp trojan activity. We have spent a lot of time writing about Carberp already, but interesting information is still coming to light. The first interesting information to attract our attention recently concerned stealing money from Facebook users. Before … Read More…

I tend not to try to compete with sites like Facecrooks that specialize in tracking malware issues: however, they've just flagged a scam that has apparently already tricked around 300,000 Facebook users into Liking a scam page, and are appealing for people to report it to Facebook in the hope of getting the scam site … Read More…

Perhaps it's some kind of link left over from all those ships from the Spanish Armada that found themselves making landfall on the West Coast of Ireland, or maybe it's an obscure allusion to the beleaguered Eurozone, but my colleague Urban Shrott passed on to me a spate of rather unusual lottery spams. You may be familiar … Read More…

I have been blogging about support scams for quite a while and I figure this might be a good time to highlight some of the snippets of information that people have posted on some of those blogs (anonymized, of course). You can also find more about these support scams on the resource page I've started … Read More…

Following an article I wrote recently for SC Magazine, Martijn Grooten of Virus Bulletin, who shares my interest in and dislike of support desk scams, contacted me about the web site associated with eFIX, a company claiming to offer online technical support. He and I, along with Steven Burn, who has a great deal of … Read More…

A week or so ago we promised you a full paper expanding on our Hodprot is a Hotshot blog. That paper is now up on the white papers page at http://www.eset.com/us/documentation/white-papers.
Title: Hodprot: Hot to Bot
By: Eugene Rodionov, Aleksandr Matrosov, and Dmitry Volkov, August 2011
Abstract: A comprehensive analysis of Win32/Hodprot, one of the families of malware … Read More…

Yeah, yeah, yet another coldcall scam post, but featuring a ploy I haven't come across before, intended to convince you that the scammer really knows something about your system, so that you're likelier to fall for the scam. 
Rebecca Herold reports for InfosecIsland that she was contacted by one of those helpful "support desk" people who … Read More…

Recession? What recession?
According to my colleague Urban Schrott, the UK is awash with so much money that the Prime Minister is mailing Irish citizens to tell them that their Overdue Inheritance payment of £2.5 million is waiting for them. The British Prime Minister, that is.
For the geographically and/or politically challenged, the Republic of Ireland hasn't … Read More…

Old western cowboys beware, this heist didn’t happen with a stagecoach at gunpoint, it’s a new era out there. A user, going by the username allinvain reports he had 25,000 Bitcoins (BTC) stolen when his computer was infected. At the current BTC exchange rate, that haul would net about $500,000. Not too shabby for a … Read More…

The US Department of Justice's announcement yesterday of the takedown of the command and  control (C&C) servers for the Coreflood bots (detected by ESET as Win32/AFCore) and seizure of their domains marks another step in the growing awareness that crime, whether it is committed with bullets or with botnets, is still crime. 
This particular botnet, about … Read More…