Tag Archives: Browsers

Researchers at Bitdefender have discovered a new malware campaign.  This one uses an attack method that has fallen out of favor in recent months, called the Exploit Kit.

Exploit Kits used to be all the rage. Flash Player was a popular target for Exploit Kit based attacks but it is now a thing of the past. Therefore, the popularity of the Exploit Kit has declined markedly.

Someone is apparently trying to give it a comeback, however. It has been made possible by the fact that there are a growing number of users on the internet who don’t prioritize updating their browser software. Notably, the users still relying on Internet Explorer are particularly vulnerable since it is no longer receiving security updates.

The latest campaign has been dubbed RIG EK. It exploits CVE-2021026411 which is a flaw in Internet Explorer that causes memory corruption when visiting a specially crafted website.  Once the group has a victim on the hook, they deploy a malware strain called RedLine which is an inexpensive but quite powerful infostealer. It is especially popular on Russian-speaking hacking forums.

Once RedLine is installed, the hackers will exfiltrate all the data they can from the victim’s device, focusing on stored payment card information, cryptocurrency wallet information, and other high value data.

The RIG EK campaign doesn’t really do anything new. However, the hackers behind it have found new ways to breathe life into older techniques that had become rarely seen on the threat landscape, and that makes it a genuine threat.

If your organization hasn’t historically prioritized browser updates, this might be a good time to consider changing that policy. If you’re still using Internet Explorer for one reason or another, it’s past time to apply some resources to the task of transitioning away from it. Even if for no other reason than to give yourself a few less headaches.

A new threat has appeared on the horizon. Even if the name is not familiar to you this malware strain is bad news indeed.

Called RedLine it is an information-stealing malware that specifically targets popular web browsers including Opera, Microsoft’s Edge browser, and Chrome.

Unfortunately, many people have come to rely on their trusty web browser to store and remember their passwords for them. RedLine takes advantage of this and the group behind the code has found a way to crack the browser open and grab the passwords stored within.

Even worse is that RedLine isn’t just isolated to a single gang or group of cyber criminals.  Instead, it is being offered as a commodity on the Dark Web. That means anybody with about $200 USD can buy a copy and start harvesting the credentials of anyone they infect.

While it is true that passwords stored inside web browsers are encrypted, RedLine can programmatically decrypt those passwords if they are logged in as the same user which is very much the case here.  RedLine runs as the user who was infected which means that all of their passwords are open to the person controlling the malware.

Although it is highly convenient the bottom line is that it’s dangerous to have all of your passwords stored inside your web browser.  If you insist on going that route, then your best bet by far is to enable two-factor authentication on every website you visit frequently that offers it. That is so at least if your passwords are compromised the hackers who gain access to the information still can’t easily access your accounts.

Given how RedLine is being marketed on the Dark Web we can expect to see a surge in attacks using the malware in the months ahead.  It’s going to get a lot worse before it starts getting any better.