Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Round-up for the Week of Mar 6 - Mar 10

Summary: Cisco Talos published a weekly threat round-up covering prevalent malware it observed, including Virut, a polymorphic file infector with worm behavior that infects external devices and contacts C&C servers, and VirLock, a polymorphic ransomware that replaces files with disguised executables, locks the screen, and tries to spread to network shares and cloud storage. The round-up also names Regrun, a worm that replicates on disk drives and USB keys and disables registry editor access; Vbswap, a Visual Basic credential harvester that pulls stored credentials from browsers, FTP and email clients after detecting mouse activity; Mira, a polymorphic worm that mimics existing files and folders and spreads via removable and mapped network drives; and a file downloader using a domain generation algorithm to install adware.

Why it matters: VirLock doesn't just encrypt files - it replaces each one with a disguised executable carrying the original icon, so a user who opens what looks like their own document runs the malware, and it then tries to spread to network shares and cloud storage.

Read the original at Cisco Talos ↗

Topics
Malware
Related