Gauss & Fin Fisher: The latest targeted malware everyone cares about.
Summary: Cisco Talos reported on two newly discovered malware families, Gauss and FinFisher, with Gauss described as modular malware that steals credentials for email, instant messaging, social network, and banking accounts, and Kaspersky Labs data placing the vast majority of Gauss infections in Lebanon, Israel, and Palestine. Talos published Snort SIDs 23799 through 23804 for Gauss command-and-control domains, SID 23824 for its HTTP check-in, SIDs 23825 and 23826 for FinFisher's static packet signatures, and ClamAV signatures W32.Trojan.Gauss-1 through -15 plus Trojan.FinFisher.
Bottom line: Gauss's concentration in Lebanon, Israel, and Palestine points to a targeted campaign rather than broad opportunism, and its fully encrypted, modular payload means the detection Talos offers rests on known command-and-control domains and a shared decryption routine rather than on the stolen data itself.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026