Resurgence of Virut?
Summary: Cisco Talos reports that the Virut file infector, active for over five years, has resurged, with its ClamAV signature HTML.Iframe-63 among the most popular over the past 10 days. The virus connects to command-and-control servers at brenz.pl or trenz.pl and injects an iFrame into local HTML files that redirects browsers to brenz.pl/rc.
Why it matters: Google Safe Browsing warned as of 5/16/2012 that brenz.pl had been used in the prior 90 days to infect several domains, so any HTML page served from an infected machine can push users toward malware.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026