Last year Symantec reported on the use of the Windows Help File (.hlp) extension as an attack vector in targeted attacks. Symantec telemetry is now increasingly seeing this attack vector being used in targeted attacks against industry and government sectors. The nefarious WinHelp files being used in these targeted attacks are detected by Symantec as Bloodhound.HLP.1 and Bloodhound.HLP.2.
 

Figure 1. Zip file attachment with malicious ....

News broke over the weekend in Japan that police had arrested three people over the past few months in relation to death threats being posted on bulletin boards and sent through email. However, it was also reported that the suspects were subsequently released without charge due to the discovery of a particular malware infection on all of the suspect’s computers that is believed to have been used to make the threats. Examples of some of the threats include a posting to a government website stating that the person posting the threat will commit mass murder in a popular shopping area; a posting to an Internet forum saying that he/she will blow up a famous shrine; an email sent to an airline company threatening to use a bomb to destroy an aircraft; and an email threatening the kindergarten where a child of the royal family attends. Police are currently investigating the connection between the threats and the malware.

From our analysis, we have confirmed that the malware is...

An ongoing social engineering attack on Skype and other instant messaging applications has been gathering momentum over the last week. The attack, which looks to have started around September 29, has to date conned over 2.5 million clicks from unsuspecting users. The attack uses the common social engineering tactic of posting a link to instant messaging applications for a potential victim to follow. The following scenario outlines the steps in the attack:
 

Figure 1. Social engineering attack scenario
 

When the victim clicks on the goo.gl link they are redirected to a URL on Hotfile.com. The Hotfile.com site prompts the victim to download a .zip file which contains the malware...

For the past three months we have been investigating a Russian attacker serving malware to hundreds of thousands of users per year. The malware is Backdoor.Proxybox, and our investigation has revealed an entire black hat operation, giving us interesting information on the operation and size of this botnet, and leading us to information that may identify the actual malware author.

Proxy services are nothing new. They are used to provide access to geographically locked content or to relay traffic for anonymity. The proxy reseller at proxybox.name sells access to proxy servers across the globe. From their front-end website, it appears as if they are a legitimate Russian proxy service, providing access to their entire list of thousands of proxies for only $40 a month. How can they provide access to so many servers for so little cash?
 

...