In the previous entry we showed examples of domains, which could be easily missclassified as DGA botnet domains. Most of them are machine generated and used in a non-malicious manner. In this entry, conversely, we will present examples of pseudo random domains, which could be used in attacks or be …

Polish team won third place in NATO Cyber Defence Exercise Locked Shields 2015. The Polish team included members from CERT Polska team. The winners this year was NATO CIRC team, and Estonian team took second place. The theme of the exercise is defending a simulated network of a fictious country …

Domain Generation Algorithms are often used in botnets to create specially crafted domain names which point to C&C servers. The main purpose of this is to make it more difficult to block connections to these servers (for example with domain blacklists) or to protect the C&C channel (and …

While researching incidents that are reported to us, we encountered a new campaign of attacks against Internet banking, this time utilizing hacked home routers. This is a variant of a method we have first observed more than a year ago. The criminals take over control of a home router and …

A new report prepared by CERT Polska was published by ENISA (European Network and Information Security Agency) today: “Actionable Information for Security Incident Response”. This publication is aimed at members of the incident response teams and everyone that collects, analyzes and shares security-related information. Exchange of information can be an …

iBanking malware was already described on our blog in connection with the attacks targeting Polish e-banking users at the end of 2013. This malware posed as a mobile antivirus application, while in reality it was use to steal one time passwords that were sent via text message. The attack scenario …

CERT Polska along with 19 other partners from 11 countries have joined forces for CyberROAD – a 7FP project aimed to identify current and future issues in the fight against cyber-crime and cyber-terrorism in order to draw a strategic roadmap for cyber security research. A detailed snapshot of the technological, social …

oday we released an important part of the n6 platform on an open source licence (GPL). The released library implements the REST API provided by the new version of n6 and it comes with mechanisms that facilitate fetching information from databases of any type. We hope that the project will …

Of all of the Polish malware families that we have seen last year, Banatrix seems to be the most technologically advanced one. This malware was used to replace the bank account number in the browser memory, however its implementation allowed an attacker to execute any arbitrary code on the victim …

In the last two weeks, the CERT team received multiple reports describing suspicious e-mail messages supposedly coming from the Warszawa Wola (a Warsaw district) Bailiff office. The message contents do not describe the alleged due in detail, thus encouraging the recipient of the message to click on the link described …