Latest Worm news

New SSH-Snake malware steals SSH keys to spread across the network

A threat actor is using an open-source network mapping tool named SSH-Snake to look for private keys undetected and move laterally on the victim infrastructure.
- Bill Toulas
- February 21, 2024
- 02:03 PM
- 2
Raspberry Robin malware evolves with early access to Windows exploits

Recent versions of the Raspberry Robin malware are stealthier and implement one-day exploits that are deployed only on systems that are susceptible to them.
- Bill Toulas
- February 10, 2024
- 10:11 AM
- 2
New P2PInfect worm malware targets Linux and Windows Redis servers

Earlier this month, security researchers discovered a new peer-to-peer (P2P) malware with self-spreading capabilities that targets Redis instances running on Internet-exposed Windows and Linux systems.
- Sergiu Gatlan
- July 20, 2023
- 08:02 AM
- 0
Raspberry Robin worm drops fake malware to confuse researchers

The Raspberry Robin malware is now trying its hand at some trickery by dropping a fake payload to confuse researchers and evade detection when it detects it's being run within sandboxes and debugging tools.
- Bill Toulas
- December 20, 2022
- 10:15 AM
- 0
Microsoft links Raspberry Robin worm to Clop ransomware attacks

Microsoft says a threat group tracked as DEV-0950 used Clop ransomware to encrypt the network of a victim previously infected with the Raspberry Robin worm.
- Sergiu Gatlan
- October 27, 2022
- 03:34 PM
- 0
Microsoft links Raspberry Robin malware to Evil Corp attacks

Microsoft has discovered that an access broker it tracks as DEV-0206 uses the Raspberry Robin Windows worm to deploy a malware downloader on networks where it also found evidence of malicious activity matching Evil Corp tactics.
- Sergiu Gatlan
- July 29, 2022
- 07:31 AM
- 0
Microsoft finds Raspberry Robin worm in hundreds of Windows networks

Microsoft says that a recently spotted Windows worm has been found on the networks of hundreds of organizations from various industry sectors.
- Sergiu Gatlan
- July 02, 2022
- 10:07 AM
- 3
New Raspberry Robin worm uses Windows Installer to drop malware

Red Canary intelligence analysts have discovered a new Windows malware with worm capabilities that spreads using external USB drives.
- Sergiu Gatlan
- May 05, 2022
- 05:36 PM
- 0
New worm and data wiper malware seen hitting Ukrainian networks

Newly discovered malware was deployed in destructive attacks against Ukrainian organizations and governmental networks before and after Russia invaded the country on February 24.
- Sergiu Gatlan
- March 01, 2022
- 09:41 AM
- 2
Microsoft: New critical Windows HTTP vulnerability is wormable

Microsoft has patched a critical flaw tagged as wormable and found to impact the latest desktop and server Windows versions, including Windows 11 and Windows Server 2022.
- Sergiu Gatlan
- January 11, 2022
- 05:02 PM
- 0
MountLocker ransomware uses Windows API to worm through networks

The MountLocker ransomware operation now uses enterprise Windows Active Directory APIs to worm through networks.
- Lawrence Abrams
- May 19, 2021
- 03:31 AM
- 0
Purple Fox malware worms its way into exposed Windows systems

Purple Fox, a malware previously distributed via exploit kits and phishing emails, has now added a worm module that allows it to scan for and infect Windows systems reachable over the Internet in ongoing attacks.
- Sergiu Gatlan
- March 23, 2021
- 04:54 PM
- 30
Ryuk ransomware now self-spreads to other Windows LAN devices

A new Ryuk ransomware variant with worm-like capabilities that allow it to spread to other devices on victims' local networks has been discovered by the French national cyber-security agency while investigating an attack in early 2021.
- Sergiu Gatlan
- February 26, 2021
- 12:37 PM
- 0
New worm turns Windows, Linux servers into Monero miners

A newly discovered and self-spreading Golang-based malware has been actively dropping XMRig cryptocurrency miners on Windows and Linux servers since early December.
- Sergiu Gatlan
- December 30, 2020
- 09:40 AM
- 0
Gitpaste-12 worm botnet returns with 30+ vulnerability exploits

Recently discovered Gitpaste-12 worm that spreads via GitHub and also hosts malicious payload on Pastebin, has returned with over 30 vulnerability exploits, according to researchers at Juniper Labs.
- Ax Sharma
- December 19, 2020
- 01:01 PM
- 0
Reverse shell botnet Gitpaste-12 spreads via GitHub and Pastebin

A newly discovered worm and botnet named Gitpaste-12 lives on GitHub and also uses Pastebin to host malicious code. The advanced malware comes equipped with reverse shell and crypto mining capabilities.
- Ax Sharma
- November 06, 2020
- 04:22 AM
- 0
FritzFrog malware attacks Linux servers over SSH to mine Monero

A sophisticated botnet campaign named FritzFrog has been discovered breaching SSH servers around the world, since at least January 2020.
- Ax Sharma
- August 19, 2020
- 06:00 AM
- 0
Cryptojacking worm steals AWS credentials from Docker systems

A cybercrime group known as TeamTNT is using a crypto-mining worm to steal plaintext AWS credentials and config files from compromised Docker and Kubernetes systems.
- Sergiu Gatlan
- August 18, 2020
- 11:39 AM
- 0
Try2Cry ransomware tries to worm its way to other Windows systems

A new ransomware known as Try2Cry is trying to worm its way onto other Windows computers by infecting USB flash drives and using Windows shortcuts (LNK files) posing as the targets' files to lure them into infecting themselves.
- Sergiu Gatlan
- July 03, 2020
- 04:20 PM
- 1
Thanos ransomware auto-spreads to Windows devices, evades security

The Thanos ransomware is the first to use a researcher-disclosed RIPlace anti-ransomware evasion technique as well as numerous other advanced features that make it a serious threat to keep an eye on.
- Lawrence Abrams
- June 10, 2020
- 02:57 PM
- 4