Donoff – Computer Security Articles

Ransomware: a declining nuisance or an evolving menace?

February 14, 2017 admin Antimalware research for IT pros and enthusiasts, Cerber, CornCrypt, Critorni, Dereilock, Donoff, exploit kit, Locky, Meadgive, Microsoft Edge, Microsoft SmartScreen, Nemucod, Neutrino, ransomware, Samas, spam, spora, Telecrypt, Troldesh, Windows 10, Windows 10 Creators Update, Windows Defender, Windows Defender ATP, Zcryptor

Credit to Author: msft-mmpc| Date: Tue, 14 Feb 2017 21:56:15 +0000

The volume of ransomware encounters is on a downward trend. Are we seeing the beginning of the end of this vicious threat? Unfortunately, a look at the attack vectors, the number of unique families released into the wild, and the improvements in malware code reveals otherwise. Ransomware was arguably the biggest security story of 2016….

Microsoft Security

No slowdown in Cerber ransomware activity as 2016 draws to a close

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, Cerber, Donoff, Exploits, holiday shopping, macro, Macro-based malware, Meadgive, ransomware, spam, Windows 10, Windows Defender, Windows Defender ATP

As everybody else winds down for the holidays, the cybercriminals behind Cerber are busy ramping up their operations. Following our discovery of a spam campaign that takes advantage of holiday shopping, we found two new campaigns that continue distributing the latest variants of Cerber ransomware. These campaigns are the latest in a series of persistent cybercriminal…

Microsoft Security

Malicious macro using a sneaky new trick

January 23, 2017 admin antimalware, Antimalware research for IT pros and enthusiasts, Donoff, guidance, Locky, macro, Macro-based malware, malware, malware research, office, ransomware, Social engineering, VBA, VBAscript, Windows 10, Windows Defender, Word

We recently came across a file (ORDER-549-6303896-2172940.docm, SHA1: 952d788f0759835553708dbe323fd08b5a33ec66) containing a VBA project that scripts a malicious macro (SHA1: 73c4c3869304a10ec598a50791b7de1e7da58f36). We added it under the detection TrojanDownloader:O97M/Donoff – a large family of Office-targeting macro-based malware that has been active for several years (see our blog category on macro-based malware for more blogs). However, there wasn’t…