{"id":182580,"date":"2016-10-12T08:29:14","date_gmt":"2016-10-12T06:29:14","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=182580"},"modified":"2016-10-12T08:31:00","modified_gmt":"2016-10-12T06:31:00","slug":"strongpity-malware-targets-winrar-and-truecrypt-users","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/182580-strongpity-malware-targets-winrar-and-truecrypt-users.html","title":{"rendered":"StrongPity malware targets WinRAR and TrueCrypt users"},"content":{"rendered":"<p><a href=\"http:\/\/usa.kaspersky.com\/about-us\/press-center\/press-releases\/2016\/Kaspersky_Lab_Reveals_Advanced_Persistent_Threat_StrongPity\" target=\"_blank\"><strong>Kaspersky Lab has found<\/strong><\/a> a stealthy threat actor known as StrongPity, which includes components that give attackers complete control of a\u00a0victim\u2019s system.<\/p>\n<p>StrongPity targeted users looking for encryption tools WinRAR and TrueCrypt.<\/p>\n<p>The StrongPity malware enables attackers to steal disk content and to download additional modules to gather communications and contacts.<\/p>\n<p>Kaspersky Lab has detected visits to StrongPity sites and the presence of StrongPity components across more than a thousand target systems.<\/p>\n<h3 class=\"my-4\">Watering holes and poisoned installers<\/h3>\n<p>To trap victims, the attackers built fraudulent websites. In one instance, they transposed two letters in a domain name to fool customers into thinking it was a legitimate installer site for WinRAR software.<\/p>\n<p>They then placed a prominent link to this malicious domain on a WinRAR distributor site in Belgium to lead unsuspecting users to their poisoned installer.<\/p>\n<p>An Italian WinRAR distributor site served the malicious StrongPity installer directly from the distributor site.<\/p>\n<p>StrongPity also directed visitors from popular software-sharing sites to its trojanized TrueCrypt installers. This activity was still ongoing at the end of September.<\/p>\n<p>The malicious links from the WinRAR distributor sites have now been removed, but at the end of September, the fraudulent TrueCrypt site was still up.<\/p>\n<h3 class=\"my-4\">Now read: <a href=\"http:\/\/mybroadband.co.za\/news\/security\/181798-a-look-inside-the-620gbps-ddos-attack.html\">A look inside the 620Gbps DDoS attack<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>StrongPity malware includes components that give attackers complete control of a victim\u2019s system.<\/p>\n","protected":false},"author":23,"featured_media":123802,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[36,799,801,39282,36324,33152],"class_list":["post-182580","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-active","tag-kaspersky-lab","tag-malware","tag-strongpity","tag-truecrypt","tag-winrar"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/182580"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=182580"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/182580\/revisions"}],"predecessor-version":[{"id":182604,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/182580\/revisions\/182604"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/123802"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=182580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=182580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=182580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}