Dynamoo's Blog

Checking these IOCs for this latest Flash 0-day came up with an interesting IP address of 89.45.67.107 which belongs to Fast Serv Inc ak...

This spam leads to Locky ransomware: Subject :       Status of invoice From :       "Rosella Setter" ordering@[redacted] Da...

This fake financial spam does not come from 123-Reg (nor is it sent to 123-Reg customers). It has a malicious attachment. From     no-r...

This fake FTC email leads to malware. Curiously, it was sent to a company that received a multimillion dollar FTC fine, but this is almost...

This spam comes in a few different variants, and it leads to Locky ransomware encrypting files with an extension ".osiris" The...

This fake financial spam leads to malware: From :    billing@secure-lgm.com Date :    21 November 2016 at 18:35 Subject :    Your Log...

The never-ending Locky ransomware onslaught continues. This fake financial spam has a malicious attachment: Subject :     Financial doc...

This spam comes from various senders, and leads to Locky ransomware: From :    Trudy Bonner Date :    27 June 2016 at 15:39 Subject :  ...

This rather terse spam run leads to Locky ransomware and appears to come from the sender's own email account ( but doesn't ). Th...

This spam has a malicious attachment, probably leading to Locky ransomware: From :    Althea Duke Date :    22 June 2016 at 16:00 Sub...

This malicious spam leads to Locky ransomware, something that we haven't seen for several weeks: From :    Lilian Fletcher Date : ...

This fake financial spam does not come from Beerhouse Self Drive but is instead a simple forgery with a malicious attachment: From :  ...

The details in these spam messages vary, with different reference numbers, sender names and dollar amounts. They all have malicious attach...

This Dridex spam takes a slightly different approach from other recent ones. Instead of attaching a malicious Office document, it download...

This fake medical email contains a malicious attachment. It's a novel approach by the bad guys, but I doubt that many people will find...

This Tweet from @Kafeine about the Angler EK drew my attention to a small block of OVH UK addresses of 5.196.33.8/29 which appear to be...

This is some sort of malware using insecure OpenX ad servers to spread. Oh wait, insecure is pretty much the default configuration for Ope...

I don't have a sample of the German-language spam spreading this attack, but it is similar to this one and it entices the victim to d...

These IPs and domains are associated with this spam run . Some of these servers have been compromised for some time by the looks of things...

This set of malicious IPs and domains is associate with this gang , and the list replaces the last one published here . 24.173.170.230 (...