NewApp Digest
search bot

network monitoring

What Is a Crypto Miner Virus?
Tech Optimizer
March 16, 2026

What Is a Crypto Miner Virus?

A crypto miner virus, or cryptojacking malware, secretly uses a device’s CPU or GPU to mine cryptocurrency for an attacker, leading to increased electricity costs and potential hardware damage for the victim. It typically infects devices through phishing emails, pirated software, compromised websites, and malicious browser extensions. Monero is the preferred cryptocurrency for mining due to its efficiency on standard CPUs and privacy features. Signs of infection include overheating, high CPU usage, and increased electricity bills. Detection involves monitoring system performance and running antivirus scans. Prevention includes using antivirus software, keeping systems updated, and avoiding pirated software. Notable incidents include attacks on a European water utility and the Los Angeles Times website.
Is Microsoft really spying on you with Windows telemetry?
Winsage
February 27, 2026

Is Microsoft really spying on you with Windows telemetry?

Windows 10 was released in 2015 and faced criticism for its telemetry feature, which some viewed as a surveillance tool. In 2017, the Dutch Data Protection Authority found Microsoft's telemetry settings non-compliant with local privacy laws, leading to changes by Microsoft. Telemetry, termed diagnostic data by Microsoft, is essential for device reliability and security, with a baseline level of data collection set to "Required." Users can opt to limit data collection to this level. The Optional category of diagnostic data may include device settings and browsing history, raising privacy concerns. Microsoft introduced the Diagnostic Data Viewer in 2018 to enhance transparency, allowing users to inspect the telemetry data sent to them. As of now, Microsoft has over a billion monthly active Windows 11 users.
MyDoom virus: What it is and why it mattered
Tech Optimizer
February 13, 2026

MyDoom virus: What it is and why it mattered

In January 2004, the MyDoom computer worm quickly spread to email inboxes in 168 countries, becoming one of the fastest-spreading pieces of malware in internet history. It exploited human behavior by enticing users to open email attachments that appeared to be delivery errors or system notifications. MyDoom replicated itself through email without corrupting files or destroying data, harvesting email addresses from infected computers to send copies to new victims. The two main variants, MyDoom.A and MyDoom.B, targeted the SCO Group and Microsoft, respectively, and demonstrated the potential for email worms to be weaponized for coordinated attacks. MyDoom primarily targeted Windows-based operating systems and used deceptive emails to propagate. Once infected, it installed a backdoor for unauthorized remote access, forming a botnet for further attacks. MyDoom's effectiveness was due to its alignment with user behavior and the limited security measures of the time, leading to significant disruptions in email communication and an estimated economic impact of approximately billion. Although no longer a current threat, MyDoom's legacy influenced modern email security protocols, leading to improved filtering, behavior-based detection, and multi-layered defense strategies.
All Microsoft Windows Users Warned As New Bot Attacks Confirmed
Winsage
November 14, 2025

All Microsoft Windows Users Warned As New Bot Attacks Confirmed

A t-shirt states, "It gets worse before it gets worse," reflecting the current situation for Microsoft users facing a zero-day vulnerability in Windows. Cybersecurity researchers report a resurgence of DanaBot, a trojan previously thought diminished after Operation Endgame, which resulted in the arrest of 16 individuals and the seizure of millions in stolen cryptocurrency. DanaBot is now operating under version 669, utilizing a new infrastructure and employing malicious emails and malvertising campaigns for attacks. Experts advise Microsoft Windows users to enhance security measures with advanced monitoring and detection systems while remaining vigilant against phishing and malvertising threats.
Russian APT abuses Windows Hyper-V for persistence and malware execution
Winsage
November 5, 2025

Russian APT abuses Windows Hyper-V for persistence and malware execution

Cyber attackers used the Import-VM and Start-VM PowerShell cmdlets to introduce a virtual machine named WSL into Hyper-V. This virtual machine hosts a compact Alpine Linux environment with two implants, CurlyShell and CurlCat, identified by Bitdefender. CurlyShell uses libcurl to connect to a command-and-control server, creating a reverse shell to execute commands and return outputs. CurlCat functions as a proxy, tunneling SSH traffic through HTTP requests to evade detection by network monitoring tools.
Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control
Tech Optimizer
October 6, 2025

Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control

Modern ransomware operations have evolved into complex, multi-stage campaigns that utilize legitimate Remote Access Tools (RATs) to maintain stealth and persistently dismantle organizational defenses. Ransomware encrypts critical data and demands ransom for restoration, with current operations being highly targeted compared to earlier mass phishing attacks. Attackers exploit trusted administrative software like AnyDesk, UltraViewer, RustDesk, and Splashtop to establish backdoors, escalate privileges, and deploy payloads across networks, moving laterally and evading detection. The ransomware kill chain consists of several stages: 1. Initial Access: Attackers gain access through credential compromise, often targeting administrator accounts. 2. Remote Tool Abuse: Attackers deploy RATs either by hijacking existing tools or performing silent installations. 3. Persistence & Privilege Consolidation: They maintain persistence using registry keys and scheduled tasks while escalating privileges. 4. Antivirus Neutralization & Anti-Forensics: Attackers stop antivirus services, manipulate policies, and clear logs to evade detection. 5. Payload Deployment & Execution: Ransomware is delivered and executed within remote sessions to avoid suspicion. Commonly abused RATs include AnyDesk, UltraViewer, AppAnywhere, RustDesk, Splashtop, and TightVNC, which have been associated with various ransomware campaigns. Understanding the tactics and techniques used by adversaries is crucial for effective defense, as they exploit legitimate tools to bypass security measures. Emerging trends include AI-driven RAT deployment, cloud-based RAT abuse, and the integration of RATs in ransomware-as-a-service offerings. A comprehensive defense strategy involves multiple layers of security, including virus protection, behavior-based detection, and application control, to counter the risks posed by RAT abuse in ransomware attacks.
New Malware Targets Crypto Users with Fake Ads, Steals Keys
Tech Optimizer
July 30, 2025

New Malware Targets Crypto Users with Fake Ads, Steals Keys

A new strain of malware is targeting cryptocurrency enthusiasts through deceptive online advertisements that mimic legitimate promotions for crypto wallets and trading platforms. This malware, described as a multi-stage infostealer, begins with an ad redirect that prompts users to download a fake update or extension. Once installed, it monitors clipboard activity to copy and alter cryptocurrency addresses, redirecting funds to attackers' wallets. The malware can evade detection by many antivirus solutions and is often hosted on platforms like GitHub disguised as open-source tools. Victims may not realize they have been compromised until their funds are stolen. Experts recommend using ad blockers, verifying URLs, utilizing hardware wallets, keeping software updated, and employing multi-factor authentication as protective measures. Regular system scans with advanced tools like Malwarebytes and training for employees on malvertising risks are also advised for enterprises.
Search