Attacks trends
Let's follow a report of a new type of compromise - an exploitation of the built-in security protections of certain Windows operating systems. In the last few days, the information security community has been monitoring the existence of such malicious payloads. Various cybercriminals have already been using this malware to propagate spam and phishing campaigns. This new type of threat has been detected in Microsoft's Edge browser, and more specifically, in the PowerShell editor. This malware was written by the group of hackers named 'votiro' (also known as 'VotIm'). According to Kaspersky Labs, the group of hackers started to focus on developing threat families. An organization that generates and sells threat protection software called 'Hotspot Shield' discovered the first attack. In order to track the spread of this threat, they created a "Live Scanning" service, which allows them to monitor its spreading in the wild. The following figure shows the list of domains and IP addresses tracked by the hackers.
In the past week, the 'votiro' group of hackers has used the PowerShell editor to exploit vulnerabilities in the Microsoft Edge browser. The malicious payload is loaded by the use of the Edge browser installed in the 'Internet Explorer' operating system. Since the payload includes the exploit code, the malware is actually not installed on the computer. Microsoft has already released a patch for this vulnerability, however, Kaspersky Lab has discovered that the threat was removed. The reason for this, is that a new version of the malicious payload was used to propagate the threat. The new version contained a different exploit code, which can be used to exploit a new vulnerability in Windows systems. Microsoft has also recently released a patch to address this problem.
Currently, the 'votiro' group of hackers is using two different malicious payloads - EdgeExploit.ms.exe and EdgeExploit.ps1. Both of these files have been posted to various anonymous file sharing websites. According to the 'Hotspot Shield' company, there are several attack campaigns using these files, which indicates that the threat is being actively exploited.
The information that we collect and analyze is used solely to improve our services and offer better threat intelligence to Kaspersky Lab users and the entire security community.
If you are the owner of the intellectual property that has been infringed, please notify us by providing the information below. for the entertainment of the ear, rather than informing an intellectual reader on the matters 3125841983
Related

Ardamax Keylogger V4.4.2 FINAL High Quality Crack [TechTools] Download 📂