In May 2018, our Advanced Threat Response Team detected an APT attack exploiting a zero-day vulnerability and captured the world’s first malicious office sample that uses a browser zero-day vulnerability.The sample exploited a use-after-free vulnerability in the VBScript engine fixed by Microsoft as CVE-2018-8174.

A new CryptoMiner Trojan named ”NewKernelCoreMiner” is discovered through the feedback from our customers that they found out the lsass.exe process utilizes abnormally high CPU capabilities. After analyzing users’ documents of their computers, it is concluded as a new type of Trojan for CryptoMining.

A type of Cryptominer Trojan ,”SystemarevMiner”, which hides cryptojacking malwares behind some scheduled tasks to avoid the antivirus software’s detection. Even if the Trojan is already detected and removed, the Trojan can still be alive as long as the script file exists.

A type of actively spreading CryptoMiner, HiddenPowerShellMiner, duplicates PowerShell component and hides itself in scheduled tasks for downloading the cryptominers. The cryptominer applications contain two types of cryptocurrencies, Ethereum and Monroe.

360 Security Center discovered the download links of a famous audio and video editor, VSDC (http://www.videosoftdev.com), has been hijacked in official website. The computer will…