Cyber Espionage | SC Media

Cyber Espionage

Microsoft adds “major” update to detect Zeus trojan

Microsoft has introduced a “fairly major” update to its Malicious Software Removal Tool to detect and kill infections of the insidious and constantly morphing data-stealing malware family known as Zbot, or Zeus. Since the software giant first added detection for Zeus last October, hundreds of thousands of Windows PCs have been expunged of the threat, prominent in banking and e-commerce fraud. But as Zeus, which recently merged code bases with SpyEye, continues to acquire advanced evasion capabilities, Microsoft has had to fight “sneakiness with sneakiness,” according to a blog post on Wednesday. The company introduced the update as part of its monthly security patches, released on Tuesday.

Tracing the advanced persistent threat: Interview with Joe Stewart

While McAfee’s recently released “Shady RAT” report concentrated on the victims of a mass cyberespionage ring, another researcher has decided to focus his attention on the adversaries behind such attacks. In a video recorded last week at the Black Hat conference in Las Vegas, Joe Stewart of Dell SecureWorks explains how he was able to trace 60 families of custom malware thanks to error messages yielded by a “connection bouncer” tool used by the hackers to hide their tracks, but which inadvertently pointed back to about a dozen command-and-control centers hosted by ISPs in China. Two of the malware families are known to have been used in the RSA SecurID breach. “It gives you a better line on attribution,” Stewart told SCMagazineUS.com.

Next post in Director's Cut Videos