<rss version="2.0"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:media="http://search.yahoo.com/mrss/">
    <channel><title>Bitdefender Labs</title><description>Daily source of cyber-threat information. Established 2001.</description><link>https://www.bitdefender.com/en-gb/blog/labs/</link><image><url>https://download.bitdefender.com/resources/images/favicon/favicon-32x32.png</url><title>Bitdefender Labs</title><link>https://www.bitdefender.com/en-gb/blog/labs/</link></image><generator>Bitdefender Blog</generator><lastBuildDate>Fri, 22 May 2026 06:34:02 GMT</lastBuildDate><atom:link href="https://www.bitdefender.com/nuxt/api/en-gb/rss/labs/top/" rel="self" type="application/rss+xml"/><ttl>1800</ttl><item><title>Active Subscription Scam Campaigns Flooding the Internet</title><description><![CDATA[Bitdefender researchers have uncovered a surge in subscription scams, both in scale and sophistication, spurred by a massive campaign involving hundreds of fraudulent websites.

What sets this campaign apart is the significant investment cybercriminals have undertaken to make these fake sites look convincingly legitimate.  

Gone are the days when a suspicious email, SMS, or basic phishing link could easily fool users. As people grow more cautious and cyber-aware, scammers are stepping up their ]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/active-subscription-scam-campaigns-flooding-the-internet</link><guid isPermaLink="false">6810e6e8d38c8a0502eefa55</guid><category><![CDATA[Scam Research]]></category><dc:creator>Răzvan GOSA</dc:creator><pubDate>Wed, 30 Apr 2025 13:02:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/04/advanced_persistent_threats.jpg" medium="image"/><content:encoded><![CDATA[Bitdefender researchers have uncovered a surge in subscription scams, both in scale and sophistication, spurred by a massive campaign involving hundreds of fraudulent websites.

What sets this campaign apart is the significant investment cybercriminals have undertaken to make these fake sites look convincingly legitimate.  

Gone are the days when a suspicious email, SMS, or basic phishing link could easily fool users. As people grow more cautious and cyber-aware, scammers are stepping up their ]]></content:encoded></item><item><title>Infected Minecraft Mods Lead to Multi-Stage, Multi-Platform Infostealer Malware</title><description><![CDATA[June 9 Update:

The oldest sample we were able to track until now (e69b50d1d58056fc770c88c514af9a82) shows the malware during its early development stage. Dated 2023-04-12, it looks like a Stage 2 sample with the C&C address set to 127.0.0.1, which leads us to believe that it was used for testing. It also includes limited functionality that currently is available in Stage 3 samples (only listening for OS commands (executed with  exec) ), which reinforces our assumption that the malware was in de]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/infected-minecraft-mods-lead-to-multi-stage-multi-platform-infostealer-malware</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722bc</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 08 Jun 2023 17:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/06/minecraft-1106252_1920.jpg" medium="image"/><content:encoded><![CDATA[June 9 Update:

The oldest sample we were able to track until now (e69b50d1d58056fc770c88c514af9a82) shows the malware during its early development stage. Dated 2023-04-12, it looks like a Stage 2 sample with the C&C address set to 127.0.0.1, which leads us to believe that it was used for testing. It also includes limited functionality that currently is available in Stage 3 samples (only listening for OS commands (executed with  exec) ), which reinforces our assumption that the malware was in de]]></content:encoded></item><item><title>Vulnerabilities identified in
Amazon Fire TV Stick, Insignia
FireOS TV Series</title><description><![CDATA[Streaming devices have become increasingly popular in recent years, and for good reason. Portable, frequently updated and relatively inexpensive when compared to a new smart TV, these devices offer a convenient, cost-effective, and customizable way to access a vast selection of content from the comfort of your own home. Smart TVs and streaming devices account for a whopping 20% [pdf] of all connected IoT devices, and potential vulnerabilities in firmware could affect a significant user base.

As]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b9</guid><category><![CDATA[IoT Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Tue, 02 May 2023 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/05/old-tv-gab6450206_1920.png" medium="image"/><content:encoded><![CDATA[Streaming devices have become increasingly popular in recent years, and for good reason. Portable, frequently updated and relatively inexpensive when compared to a new smart TV, these devices offer a convenient, cost-effective, and customizable way to access a vast selection of content from the comfort of your own home. Smart TVs and streaming devices account for a whopping 20% [pdf] of all connected IoT devices, and potential vulnerabilities in firmware could affect a significant user base.

As]]></content:encoded></item><item><title>EyeSpy - Iranian Spyware Delivered in VPN Installers</title><description><![CDATA[Consumer VPN solutions have witnessed explosive growth in the past few years. These ubiquitous utilities help users keep their internet traffic private, surf anonymously, and bypass restrictions or censorship. And, while most of the world takes this technology for granted,  users in specific regions - such as the people in Iran - have to try out dozens of apps before they find one that is (still) able to bypass ISP restrictions. And, while some VPNs are fake [here is a guide on how to spot a fak]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/eyespy-iranian-spyware-delivered-in-vpn-installers</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b5</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Janos Gergo SZELES</dc:creator><pubDate>Wed, 11 Jan 2023 10:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/01/eyespy-1.jpg" medium="image"/><content:encoded><![CDATA[Consumer VPN solutions have witnessed explosive growth in the past few years. These ubiquitous utilities help users keep their internet traffic private, surf anonymously, and bypass restrictions or censorship. And, while most of the world takes this technology for granted,  users in specific regions - such as the people in Iran - have to try out dozens of apps before they find one that is (still) able to bypass ISP restrictions. And, while some VPNs are fake [here is a guide on how to spot a fak]]></content:encoded></item><item><title>Bitdefender Partnership with Law Enforcement Yields MegaCortex Decryptor</title><description><![CDATA[We have just released a decryptor for the MegaCortex ransomware family. This decryptor was built in cooperation with Europol, the NoMoreRansom Project, the Zürich Public Prosecutor's Office and the Zürich Cantonal Police.


Context

In October 2021, twelve individuals were arrested in an international law enforcement operation against Dharma, MegaCortex and LockerGoga ransomware.

This group was responsible for an estimated 1,800 infections, mostly targeting companies. Following the LockerGoga d]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/bitdefender-partnership-with-law-enforcement-yields-megacortex-decryptor</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b4</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 05 Jan 2023 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/01/decryptors.jpeg" medium="image"/><content:encoded><![CDATA[We have just released a decryptor for the MegaCortex ransomware family. This decryptor was built in cooperation with Europol, the NoMoreRansom Project, the Zürich Public Prosecutor's Office and the Zürich Cantonal Police.


Context

In October 2021, twelve individuals were arrested in an international law enforcement operation against Dharma, MegaCortex and LockerGoga ransomware.

This group was responsible for an estimated 1,800 infections, mostly targeting companies. Following the LockerGoga d]]></content:encoded></item><item><title>BackdoorDiplomacy Wields New Tools in Fresh Middle East Campaign</title><description><![CDATA[Bitdefender researchers have uncovered a new cyber-espionage campaign targeting a telecommunications firm in the Middle East. While investigating a set of binaries vulnerable to sideloading attacks, we identified a cyber-espionage operation most likely carried out by Chinese threat actor BackdoorDiplomacy.

Who is BackdoorDiplomacy?

APT group BackdoorDiplomacy, which has been operating at least since 2017, is known for its attacks against institutions in the Middle East and Africa as well as in]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/backdoor-diplomacy-wields-new-tools-in-fresh-middle-east-campaign</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b2</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Adrian SCHIPOR</dc:creator><pubDate>Tue, 06 Dec 2022 14:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/12/Data_Protection_-_Digital_Umbrella_Over_Binary_Code.jpg" medium="image"/><content:encoded><![CDATA[Bitdefender researchers have uncovered a new cyber-espionage campaign targeting a telecommunications firm in the Middle East. While investigating a set of binaries vulnerable to sideloading attacks, we identified a cyber-espionage operation most likely carried out by Chinese threat actor BackdoorDiplomacy.

Who is BackdoorDiplomacy?

APT group BackdoorDiplomacy, which has been operating at least since 2017, is known for its attacks against institutions in the Middle East and Africa as well as in]]></content:encoded></item><item><title>Side-Loading OneDrive for profit – Cryptojacking campaign detected in the wild</title><description><![CDATA[Cryptojackers have become very lucrative for cybercriminals in recent years as the price of cryptocurrency soared. From data breaches to PUAs to warez downloads, coin miners and cryptojackers crop up steadily in our threat landscape reports.

However, to meet their financial expectations, cybercriminals are taking new approaches to planting and loading cryptojackers on victims’ computers. This is the case of an active cryptojacking campaign that uses a Dynamic Library Link (DLL) hijacking vulner]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/side-loading-onedrive-for-profit-cryptojacking-campaign-detected-in-the-wild</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722af</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Balint SZABO</dc:creator><pubDate>Wed, 05 Oct 2022 13:00:07 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/10/Payments_Concept.jpg" medium="image"/><content:encoded><![CDATA[Cryptojackers have become very lucrative for cybercriminals in recent years as the price of cryptocurrency soared. From data breaches to PUAs to warez downloads, coin miners and cryptojackers crop up steadily in our threat landscape reports.

However, to meet their financial expectations, cybercriminals are taking new approaches to planting and loading cryptojackers on victims’ computers. This is the case of an active cryptojacking campaign that uses a Dynamic Library Link (DLL) hijacking vulner]]></content:encoded></item><item><title>A Red Team Perspective on the Device42 Asset Management Appliance</title><description><![CDATA[Modern IT environments rely on automatic discovery, asset management, and dependency mapping.

Whether based on agents or completely agentless, these tools allow IT infrastructure managers to create a complete inventory of networked devices, servers and hypervisors, applications, and more.

While investigating the Device42 platform, we found multiple severe security issues exploitable by attackers with any level of access within the host network.

By exploiting these issues, an attacker could im]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722aa</guid><category><![CDATA[Whitepapers]]></category><category><![CDATA[Miscellaneous]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 10 Aug 2022 10:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/08/Internet_Security_Concept_-_Safe_and_Secure_Network.jpg" medium="image"/><content:encoded><![CDATA[Modern IT environments rely on automatic discovery, asset management, and dependency mapping.

Whether based on agents or completely agentless, these tools allow IT infrastructure managers to create a complete inventory of networked devices, servers and hypervisors, applications, and more.

While investigating the Device42 platform, we found multiple severe security issues exploitable by attackers with any level of access within the host network.

By exploiting these issues, an attacker could im]]></content:encoded></item><item><title>Vulnerabilities Identified in Wyze Cam IoT Device</title><description><![CDATA[At Bitdefender, we care deeply about security, so we’ve been working with media partners and IoT devices manufacturers to identify vulnerabilities in the world’s best-selling connected devices. As a leading vendor of cybersecurity protection across endpoint and IoT devices, we have been assessing the security of smart-home equipment for more than half a decade. Our goal is to help vendors and customers stay on top of security and privacy blind spots and make the IoT ecosystem safer for everybody]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/vulnerabilities-identified-in-wyze-cam-iot-device</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722a2</guid><category><![CDATA[IoT Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Tue, 29 Mar 2022 13:03:20 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/03/smart-home-gfd3bc417c_1920.jpg" medium="image"/><content:encoded><![CDATA[At Bitdefender, we care deeply about security, so we’ve been working with media partners and IoT devices manufacturers to identify vulnerabilities in the world’s best-selling connected devices. As a leading vendor of cybersecurity protection across endpoint and IoT devices, we have been assessing the security of smart-home equipment for more than half a decade. Our goal is to help vendors and customers stay on top of security and privacy blind spots and make the IoT ecosystem safer for everybody]]></content:encoded></item><item><title>New FluBot and TeaBot Global Malware Campaigns Discovered</title><description><![CDATA[Some malware and phishing campaigns have short lives, tending to dissipate after they're identified by security solutions. Others seem to survive year after year, with victims falling for the same tricks. Banking trojans such as TeaBot and FluBot and the "Is it you in the video?" scams are just two examples of threats that adapt to remain relevant.

The impact of TeaBot and FluBot trojans became apparent last year globally. Threat actors used mockups of popular apps, applications posing as ad-bl]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/new-flubot-and-teabot-global-malware-campaigns-discovered</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722a0</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 26 Jan 2022 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/01/sms-mini.jpg" medium="image"/><content:encoded><![CDATA[Some malware and phishing campaigns have short lives, tending to dissipate after they're identified by security solutions. Others seem to survive year after year, with victims falling for the same tricks. Banking trojans such as TeaBot and FluBot and the "Is it you in the video?" scams are just two examples of threats that adapt to remain relevant.

The impact of TeaBot and FluBot trojans became apparent last year globally. Threat actors used mockups of popular apps, applications posing as ad-bl]]></content:encoded></item><item><title>Bitdefender Honeypots Signal Active Log4Shell 0-Day Attacks Underway; Patch Immediately</title><description><![CDATA[Log4Shell is a 0-day vulnerability in the Log4j Java library that allows attackers to download and run scripts on targeted servers, leaving them open to complete remote control. After a user posted a proof-of-concept (PoC) on Twitter, Bitdefender’s honeypots started to register attacks using the PoC, underlining just how severe this vulnerability is.

Log4j is not just another Java library. It’s embedded in servers and services from all over the world, used by companies such as Apple, Amazon, Cl]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/bitdefender-honeypots-signal-active-log4shell-0-day-attacks-underway-patch-immediately</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d7229d</guid><category><![CDATA[Miscellaneous]]></category><dc:creator>Silviu STAHIE</dc:creator><pubDate>Fri, 10 Dec 2021 19:46:17 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/12/markus-spiske-70Rir5vB96U-unsplash.jpg" medium="image"/><content:encoded><![CDATA[Log4Shell is a 0-day vulnerability in the Log4j Java library that allows attackers to download and run scripts on targeted servers, leaving them open to complete remote control. After a user posted a proof-of-concept (PoC) on Twitter, Bitdefender’s honeypots started to register attacks using the PoC, underlining just how severe this vulnerability is.

Log4j is not just another Java library. It’s embedded in servers and services from all over the world, used by companies such as Apple, Amazon, Cl]]></content:encoded></item><item><title>Bitdefender, Law Enforcement Partnership Saves REvil Victims Half a Billion in Ransom Demand</title><description><![CDATA[More than three years ago, in February 2018, the Bitdefender DRACO Team released the first of many decryptors for a family of ransomware called GandCrab. Published just one month after the emergence of the first samples of this extremely powerful ransomware-as-a-service (RaaS) offering, this marked the beginning of a complex partnership with law enforcement agencies around the world on a strong commitment to curb ransomware.

Now, Romanian authorities have arrested two affiliates of the Sodinoki]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/bitdefender-law-enforcement-partnership-saves-revil-victims-half-a-billion-in-ransom-demand</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d7229c</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bogdan Botezatu</dc:creator><pubDate>Mon, 08 Nov 2021 14:05:03 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/11/DracoTeam_visuals_01.jpg" medium="image"/><content:encoded><![CDATA[More than three years ago, in February 2018, the Bitdefender DRACO Team released the first of many decryptors for a family of ransomware called GandCrab. Published just one month after the emergence of the first samples of this extremely powerful ransomware-as-a-service (RaaS) offering, this marked the beginning of a complex partnership with law enforcement agencies around the world on a strong commitment to curb ransomware.

Now, Romanian authorities have arrested two affiliates of the Sodinoki]]></content:encoded></item><item><title>Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware</title><description><![CDATA[**Update: September 20, 2021

We are glad to report that hundreds of victims and counting have been able to decrypt their data. We also wanted to report that we resolved an issue that could affect a small subset of victims using the decryptor in a particular setting. We immediately reconfigured the decryptor and delivered an update within hours. Victims using all encryption modes can safely decrypt their data.

Bitdefender announced the availability of a universal decryptor for REvil/Sodinokibi.]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/bitdefender-offers-free-universal-decryptor-for-revil-sodinokibi-ransomware</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d7229a</guid><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 16 Sep 2021 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/11/ransomware-decryption-tools-banner-1-1.jpeg" medium="image"/><content:encoded><![CDATA[**Update: September 20, 2021

We are glad to report that hundreds of victims and counting have been able to decrypt their data. We also wanted to report that we resolved an issue that could affect a small subset of victims using the decryptor in a particular setting. We immediately reconfigured the decryptor and delivered an update within hours. Victims using all encryption modes can safely decrypt their data.

Bitdefender announced the availability of a universal decryptor for REvil/Sodinokibi.]]></content:encoded></item><item><title>LuminousMoth – PlugX, File Exfiltration and Persistence Revisited</title><description><![CDATA[Foreword

A few months ago, Bitdefender researchers started to investigate an extended operation that targeted victims from Myanmar and Thailand for what looked like cyber espionage and intelligence gathering.

Many aspects of this operation were recently comprehensively described in this article by the Kaspersky team, but we decided to present our perspective on the operation and offer other IOCs we spotted.

The investigation started with our usual triage process where we observed suspicious a]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72297</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Victor VRABIE</dc:creator><pubDate>Wed, 21 Jul 2021 17:20:21 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/07/antivirus-5930412_1920.jpg" medium="image"/><content:encoded><![CDATA[Foreword

A few months ago, Bitdefender researchers started to investigate an extended operation that targeted victims from Myanmar and Thailand for what looked like cyber espionage and intelligence gathering.

Many aspects of this operation were recently comprehensively described in this article by the Kaspersky team, but we decided to present our perspective on the operation and offer other IOCs we spotted.

The investigation started with our usual triage process where we observed suspicious a]]></content:encoded></item><item><title>How We Tracked a Threat Group Running an Active Cryptojacking Campaign</title><description><![CDATA[Bitdefender security researchers have discovered a threat group likely based in Romania that's been active since at least 2020. They've been targeting Linux-based machines with weak SSH credentials, mainly to deploy Monero mining malware, but their toolbox allows for other kinds of attacks.

Hackers going after weak SSH credentials is not uncommon. Among the biggest problems in security are default user names and passwords, or weak credentials hackers can overcome easily with brute force. The tr]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/how-we-tracked-a-threat-group-running-an-active-cryptojacking-campaign</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72294</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 14 Jul 2021 08:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/07/Group-of-Teenage-Hackers-Organize-Attack-on-Corporate-Data-Servers.-Their-Lair-is-Dark-and-Full-of-Operating-Displays.-817486038_5000x2813.jpeg" medium="image"/><content:encoded><![CDATA[Bitdefender security researchers have discovered a threat group likely based in Romania that's been active since at least 2020. They've been targeting Linux-based machines with weak SSH credentials, mainly to deploy Monero mining malware, but their toolbox allows for other kinds of attacks.

Hackers going after weak SSH credentials is not uncommon. Among the biggest problems in security are default user names and passwords, or weak credentials hackers can overcome easily with brute force. The tr]]></content:encoded></item></channel>
        </rss>