article thumbnail

Kasseika ransomware uses antivirus driver to kill other antiviruses

Bleeping Computer

A recently uncovered ransomware operation named 'Kasseika' has joined the club of threat actors that employs Bring Your Own Vulnerable Driver (BYOVD) tactics to disable antivirus software before encrypting files. [.]

Antivirus 123
article thumbnail

Adventures in Contacting the Russian FSB

Krebs on Security

In the process of doing so, I encountered a small snag: The FSB’s website said in order to communicate with them securely, I needed to download and install an encryption and virtual private networking (VPN) appliance that is flagged by at least 20 antivirus products as malware. The FSB headquarters at Lubyanka Square, Moscow.

Antivirus 335
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

On the Irish Health Services Executive Hack

Schneier on Security

Antivirus software triggered numerous alerts after detecting Cobalt Strike activity but these were not escalated. The antivirus server was later encrypted in the attack). across the IT estate and reliance was placed on a single antivirus product that was not monitored or effectively maintained with updates across the estate.

Antivirus 310
article thumbnail

‘Tis the season for protecting your devices with Webroot antivirus

Webroot

Whether you purchase a new device or receive one as a gift, now is the time to consider the importance of protecting it with an antivirus program. What is antivirus? Antivirus programs accomplish this by conducting behavior-based detection, scans, virus quarantine and removal. Do I really need antivirus? In a word, yes.

Antivirus 132
article thumbnail

Hackers hijacked the eScan Antivirus update mechanism in malware campaign

Security Affairs

A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute backdoors and cryptocurrency miners. Avast researchers discovered and analyzed a malware campaign that exploited the update mechanism of the eScan antivirus to distribute backdoors and crypto miners.

Antivirus 131
article thumbnail

LockFile Ransomware uses a new intermittent encryption technique

Security Affairs

Recently emerged LockFile ransomware family LockFile leverages a novel technique called intermittent encryption to speed up encryption. Sophos researchers discovered that the group is now leveraging a new technique called “intermittent encryption” to speed up the encryption process.

article thumbnail

LockFile ransomware uses intermittent encryption to evade detection

CSO Magazine

The threat uses what researchers from antivirus vendor Sophos call “intermittent encryption,” meaning it only encrypts chunks of data inside a file instead of its complete contents. Key to its success are a few new tricks that make it harder for anti-ransomware solutions to detect it.