Fortinet Blog | News and Threat Research

Android/Claco.A!tr is a new mobile malware that has been in the news recently for it’s unique ability to infect PCs. Even though we’ve seen an attack vector of this kind on the Symbian OS before (SymbOS/CardTrap), ...

Feel free to browse through our Zitmo timeline. Please note that variant naming depends on many factors including but not limited to chronology. Hence variant letters (.A) don’t always reflect the order of appearance in t...

Mobile botnet Android/RootSmart (aka Bmaster) is making substantial amount of money from premium SMS numbers or services, according to Cathal Mullaney’s discovery of a mobile botnet front-end: yes, we had told you so. ...

Once upon a time in 2009 the City of Bozeman, Montana found itself at the brunt of a public firestorm when it became known that members had the audacity to request social networking credentials from applicants. Oh, those were ...

“Big” seemed to epitomize last week in security—from big botnet takedowns to big breaches to big privacy issues related to a certain social networking site. Here is this week’s lowdown. Zeus Takedown: Microsoft kicked of...

Mark Balanza has spotted a new Android malware, Android/CruseWin.A!tr, which acts as an SMS relay. The malicious application is in contact with a remote C&C from which it gets an XML configuration file which contains the c...

A few days ago, a new malware named Android/Smspacem.A!tr appeared for Android users. This malware trojans a legitimate (but controversial) application named the Holy Fing Bible. Its malicious behavior only appeared on May 21-2...

On this episode of Network World’s Security Landscape, Derek Manky from Fortinet and Keith Shaw discuss the latest security threats seen worldwide. This includes the rise of do-it-yourself crimeware botnet kits, as well a...

When analyzing a new botnet, I tend to focus heavily on the network messages. After all, they are the glue that holds the botnet together. So one of the first things I did, when working on our new analysis of the Ozdok/Mega-D b...

While looking at some Pushdo botnet messages recently, I noticed a repeating pattern in the data. Here is an example, taken from an area where the pattern is most obvious: 0340  13 63 cc 69 13 63 cc 69 13 63 cc 69 53 63 cc 2b ...