ClamAV and Snort coverage for Flashback and Sabpub
Summary: Cisco Talos wrote 20 ClamAV signatures for Flashback, which had reached 11 variants (up to Flashback.K) and was mostly based on two widely copied masters it names OSX.Flashback-8 and OSX.Flashback-12, while a single signature covered all 3 Sabpub variants under the name OSX.Subpub. Snort coverage ran for the same period, with Sid 21877 for Sabpub and Sids 20762, 21755, 21756, 21757, 21758 and 21910 for Flashback, and Apple's removal tool deletes Flashback on install without manual steps.
Bottom line: Eleven Flashback variants traced back to just two masters, which is why 20 signatures were needed for one family while Sabpub's 3 variants took one - signature volume tracks how much an attacker reworks the code, not how many campaigns exist.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026