• Vidar stealer campaign targeting Baltic region and NATO entities

    Article thumbnail

    While working on our automatic configuration extractors, we came across a rather strange-looking Vidar sample. The decrypted strings included domain names of such organizations as the NATO Strategic Communications Centre of Excellence, Border Guard of Poland, Estonia and Latvia, and Ministry of the Interior of Lithuania. Automatically extracted strings from …

    Read more
  • 22 June 2021 CERT Polska #secure #cfp

    CFP Secure 2021

    Article thumbnail

    Why SECURE? Do you value hard work and facing challenges? Do you want to meet people like you, share your job results, look for inspiration or partners to mutual projects? You can find it all in October on our conference. We invite you to contribute to the agenda of the …

    Read more
  • 23 March 2020 CERT Polska #phishing

    List of malicious domains

    Article thumbnail

    With the help of telecommunications operators, we are starting a war against phishing sites that target personal data, banking information and social media accounts. In response to the growing number of phishing incidents related to the coronavirus pandemic, we are launching a list of malicious domains targeting Polish users. It …

    Read more
  • Free decryption tool for Mapo ransomware

    Article thumbnail

    We are happy to announce that we are releasing a free decryption tool for the Mapo (a GarrantyDecrypt/Outsider variant) ransomware today. We would also like to thank Maciej Kotowicz of Kaspersky’s GReAT for sharing his insights on the ransomware’s encryption process. Our tool works with encrypted files …

    Read more
  • 16 January 2019 CERT Polska #malware #mwdb #tools

    MWDB – our way to share information about malicious software

    Article thumbnail

    Analysis of current threats is one of the most common challenges facing almost any organization dealing with cybersecurity. From year to year, it also becomes a harder nut to crack, being undoubtedly influenced by the growing scale of activities undertaken by criminals and the degree of their advancement. In the …

    Read more
  • Dorkbot botnets disruption

    Article thumbnail

    CERT Polska has partnered together with Microsoft, ESET and law enforcement agencies including US-CERT/DHS, FBI, Interpol and Europol in activities aimed at disrupting of the Dorkbot malware family. This disruption – which includes sinkholing of the botnet’s infrastructure – took place yesterday. Dorkbot is a well-known family of malware, operating …

    Read more
  • Talking to Dridex (part 0) – inside the dropper

    Article thumbnail

    Intro Dridex mostly comes to us as spam which contains a .doc with some macros, responsible for downloading a dropper. One can quickly analyze it using oledump.py and looking through vbscript, or naturally, just try to run it in a sandbox and obtain the dropped files. CFG extraction After …

    Read more
  • 24 July 2015 CERT Polska

    CyberROAD – Invitation to participate in project surveys #2 & #3

    Article thumbnail

    CERT Polska along with 19 other partners from 11 countries have joined forces for CyberROAD – a 7FP project aimed to identify current and future issues in the fight against cyber-crime and cyber-terrorism in order to draw a strategic roadmap for cyber security research. A detailed snapshot of the technological, social …

    Read more
  • 25 May 2015 CERT Polska #malware

    Threats in Polish networks – CERT Polska 2014 report (English version)

    Article thumbnail

    Today, we published the annual CERT Polska report in its English version. This report presents the most important trends and observations that we think shaped Polish cybersecurity in 2014. This includes new, upcoming threats, their evolution and our responses to them. In 2014 CERT Polska continued its effort to better …

    Read more
  • Malware attack on both Windows and Android

    Article thumbnail

    On the 7th of May, 2015 we observed a new malicious e-mail campaign, which used the logo and the name of Polish Post Office (”Poczta Polska”). The e-mail supposedly informed about an undelivered package – however, they also included a link which, after several redirects, lead to the download of a …

    Read more