Webinject Analysis: Newsidran.com

Known for redirection attacks, recent Trickbot banking trojan campaigns use server-side injection and target fewer victims.

8 min read

We detail the steps for decrypting and decompressing IcedID webinject files, enabling researchers to analyze IcedID samples and pull out target and web injection files.

6 min read

Webinject crafting is a separate profession now. Hackers write webinjects and sell them to fraudsters, who use them to weaponize Trojans.

3 min read

Tinba, also known as "Tinybanker", "Zusy" and "HµNT€R$", is a banking Trojan.

2 min read

Trickbot authors gain precious time to defraud unsuspecting victims by adding an encryption layer that slows down the malware investigation process.

4 min read

Ramnit’s latest twist includes targeting the most widely used web services during the holidays: online retailers, entertainment, banking, food delivery, and shipping sites.

10 min read

TrickBot kicked into high gear coming into August with the most targeted URLs since its launch. It released a new worm module, shifted its focus towards the US, and soared past the one thousand target URL mark in a single configuration.

13 min read

As TrickBot evolves, we examine version 24, which heavily targets Nordic financial institutions, and we take a close look at the Dyre–TrickBot connection.

13 min read

TrickBot shows no signs of slowing down as new targets are added and command and control servers hide within web hosting providers’ networks.

10 min read