<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	xmlns:georss="http://www.georss.org/georss" xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" xmlns:media="http://search.yahoo.com/mrss/"
	>

<channel>
	<title>Webroot Threat Blog &#187; Threat Research</title>
	<atom:link href="http://blog.webroot.com/category/threat-research/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.webroot.com</link>
	<description>WEBROOT - INSIGHTS INTO THREATS AND TRENDS FROM OUR INTERNET SECURITY EXPERTS</description>
	<lastBuildDate>Sat, 11 Feb 2012 02:04:59 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.com/</generator>
<cloud domain='blog.webroot.com' port='80' path='/?rsscloud=notify' registerProcedure='' protocol='http-post' />
<image>
		<url>http://0.gravatar.com/blavatar/2f6f528880dcd9039e50bf3a1b6b8a40?s=96&#038;d=http%3A%2F%2Fs2.wp.com%2Fi%2Fbuttonw-com.png</url>
		<title>Webroot Threat Blog &#187; Threat Research</title>
		<link>http://blog.webroot.com</link>
	</image>
	<atom:link rel="search" type="application/opensearchdescription+xml" href="http://blog.webroot.com/osd.xml" title="Webroot Threat Blog" />
	<atom:link rel='hub' href='http://blog.webroot.com/?pushpress=hub'/>
		<item>
		<title>The United Nations hacked, Team Poison claims responsibility</title>
		<link>http://blog.webroot.com/2012/02/10/the-united-nations-hacked-team-poison-claims-responsibility/</link>
		<comments>http://blog.webroot.com/2012/02/10/the-united-nations-hacked-team-poison-claims-responsibility/#comments</comments>
		<pubDate>Sat, 11 Feb 2012 01:33:33 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Anonymous]]></category>
		<category><![CDATA[Hacking]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[Team Poison]]></category>
		<category><![CDATA[United Nations]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=6010</guid>
		<description><![CDATA[By Dancho Danchev A well known group of hackers has penetrated the networks of the United Nations, according to a note posted on Pastebin.com. The group claiming responsibility is Team Poison, a hacking group closely associated with the Anonymous hactivist movement. Team Poison members include TriCk, iN^SaNe, MLT,Phantom~, C0RPS3, f0rsaken, aXioM and ap0calypse. More details: The [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=6010&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/02/10/the-united-nations-hacked-team-poison-claims-responsibility/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/united_nations.jpg" medium="image">
			<media:title type="html">United_Nations</media:title>
		</media:content>
	</item>
		<item>
		<title>Researchers intercept two client-side exploits serving malware campaigns</title>
		<link>http://blog.webroot.com/2012/02/08/researchers-intercept-two-client-side-exploits-serving-malware-campaigns/</link>
		<comments>http://blog.webroot.com/2012/02/08/researchers-intercept-two-client-side-exploits-serving-malware-campaigns/#comments</comments>
		<pubDate>Wed, 08 Feb 2012 23:52:50 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Downloaders]]></category>
		<category><![CDATA[Firefox]]></category>
		<category><![CDATA[Google Chrome]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[Keyloggers]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Passwords]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Trojans]]></category>
		<category><![CDATA[BlackHole Web Malware Exploitation Kit]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Exploits]]></category>
		<category><![CDATA[Malicious Software]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[vulnerabilities]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5977</guid>
		<description><![CDATA[By Dancho Danchev Security researchers from Webroot have intercepted two currently live client-side exploits serving malware campaigns that have already managed to infect over 20,000 PCs across the globe, primarily in the United States. Based upon detailed analysis, it can be concluded that both campaigns are launched by the same cybercriminal. More details: Using the [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5977&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/02/08/researchers-intercept-two-client-side-exploits-serving-malware-campaigns/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/client_side_exploits_malware_campaign_01.png" medium="image">
			<media:title type="html">client_side_exploits_malware_campaign_01</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/client_side_exploits_malware_campaign_01_1.png" medium="image">
			<media:title type="html">client_side_exploits_malware_campaign_01_1</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/client_side_exploits_malware_campaign_02.png" medium="image">
			<media:title type="html">client_side_exploits_malware_campaign_02</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/client_side_exploits_malware_campaign_02_02.png" medium="image">
			<media:title type="html">client_side_exploits_malware_campaign_02_02</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/client_side_exploits_malware_campaign_02_03.png" medium="image">
			<media:title type="html">client_side_exploits_malware_campaign_02_03</media:title>
		</media:content>
	</item>
		<item>
		<title>Researchers spot Citadel, a ZeuS crimeware variant</title>
		<link>http://blog.webroot.com/2012/02/08/researchers-spot-citadel-a-zeus-crimeware-variant/</link>
		<comments>http://blog.webroot.com/2012/02/08/researchers-spot-citadel-a-zeus-crimeware-variant/#comments</comments>
		<pubDate>Wed, 08 Feb 2012 20:35:53 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Downloaders]]></category>
		<category><![CDATA[Keyloggers]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Passwords]]></category>
		<category><![CDATA[rootkit]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Trojans]]></category>
		<category><![CDATA[Citadel Crimeware]]></category>
		<category><![CDATA[Crimeware]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malicious Software]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[ZeuS Crimeware]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5966</guid>
		<description><![CDATA[By Dancho Danchev Security researchers from &#8220;Tracking Cyber Crime&#8221; have spotted a new ZeuS crimeware variant, that&#8217;s based on the leaked ZeuS source code from last year. Dubbed Citadel, the crimeware is positioned as a universal spyware system, whose modular nature allows cybercriminals to offer flexibly priced value-added services such as managed malware crypting, and [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5966&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/02/08/researchers-spot-citadel-a-zeus-crimeware-variant/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/citadel_zeus_crimeware_variant.png" medium="image">
			<media:title type="html">Citadel_ZeuS_Crimeware_Variant</media:title>
		</media:content>
	</item>
		<item>
		<title>A peek inside the Smoke Malware Loader</title>
		<link>http://blog.webroot.com/2012/02/03/a-peek-inside-the-smoke-malware-loader/</link>
		<comments>http://blog.webroot.com/2012/02/03/a-peek-inside-the-smoke-malware-loader/#comments</comments>
		<pubDate>Sat, 04 Feb 2012 00:07:31 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Keyloggers]]></category>
		<category><![CDATA[Passwords]]></category>
		<category><![CDATA[Downloaders]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Trojans]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malicious Software]]></category>
		<category><![CDATA[Malware Loader]]></category>
		<category><![CDATA[Smoke Malware Loader]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5947</guid>
		<description><![CDATA[By Dancho Danchev The competitive arms race between security vendors and malicious cybercriminals constantly produces new defensive mechanisms, next to new attack platforms and malicious tools aiming to efficiently exploit and infect as many people as possible. Continuing the &#8220;A peek inside&#8230;&#8221; series, in this post I will profile yet another malware loader. This time it&#8217;s [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5947&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/02/03/a-peek-inside-the-smoke-malware-loader/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/smoke_malware_loader_01.png" medium="image">
			<media:title type="html">Smoke_Malware_Loader_01</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/smoke_malware_loader_02.png" medium="image">
			<media:title type="html">Smoke_Malware_Loader_02</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/smoke_malware_loader_03.png" medium="image">
			<media:title type="html">Smoke_Malware_Loader_03</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/smoke_malware_loader_04.png" medium="image">
			<media:title type="html">Smoke_Malware_Loader_04</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/smoke_malware_loader_05.png" medium="image">
			<media:title type="html">Smoke_Malware_Loader_05</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/smoke_malware_loader_06.png" medium="image">
			<media:title type="html">Smoke_Malware_Loader_06</media:title>
		</media:content>
	</item>
		<item>
		<title>Research: Google&#8217;s reCAPTCHA under fire</title>
		<link>http://blog.webroot.com/2012/02/01/research-googles-recaptcha-under-fire/</link>
		<comments>http://blog.webroot.com/2012/02/01/research-googles-recaptcha-under-fire/#comments</comments>
		<pubDate>Wed, 01 Feb 2012 23:03:27 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[captcha]]></category>
		<category><![CDATA[Google]]></category>
		<category><![CDATA[ReCaptcha]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5925</guid>
		<description><![CDATA[By Dancho Danchev Who needs automated bots solving CAPTCHAs, when you have teams of low-waged humans recognizing them for pennies? In an underground cybercrime ecosystem dominated by managed services and countless outsourcing opportunities, it&#8217;s fairly logical to assume that Google&#8217;s reCAPTCHA is under constant fire. Just how easy is it to recognize reCAPTCHA images for [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5925&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/02/01/research-googles-recaptcha-under-fire/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/02/recaptcha.png" medium="image">
			<media:title type="html">reCAPTCHA</media:title>
		</media:content>
	</item>
		<item>
		<title>Cybercriminals generate malicious Java applets using DIY tools</title>
		<link>http://blog.webroot.com/2012/01/30/cybercriminals-generate-malicious-java-applets-using-diy-tools/</link>
		<comments>http://blog.webroot.com/2012/01/30/cybercriminals-generate-malicious-java-applets-using-diy-tools/#comments</comments>
		<pubDate>Mon, 30 Jan 2012 22:22:55 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Backdoors]]></category>
		<category><![CDATA[Downloaders]]></category>
		<category><![CDATA[Firefox]]></category>
		<category><![CDATA[Google Chrome]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[Keyloggers]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[social engineering]]></category>
		<category><![CDATA[Stupid malware tricks]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Trojans]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[DIY]]></category>
		<category><![CDATA[Java Applet]]></category>
		<category><![CDATA[Malicious Software]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5911</guid>
		<description><![CDATA[By Dancho Danchev Who said there&#8217;s such a thing as a trusted Java applet? In situations where malicious attackers cannot directly exploit client-side vulnerabilities on the targeted host, they will turn to social engineering tricks, like legitimate-looking Java Applets, which will on the other hand silently download the malicious payload of the attacker, once the [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5911&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/01/30/cybercriminals-generate-malicious-java-applets-using-diy-tools/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/malicious_jave_applet_generator_01.png" medium="image">
			<media:title type="html">Malicious_Jave_Applet_Generator_01</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/malicious_jave_applet_generator_02.png" medium="image">
			<media:title type="html">Malicious_Jave_Applet_Generator_02</media:title>
		</media:content>
	</item>
		<item>
		<title>A peek inside the uBot malware bot</title>
		<link>http://blog.webroot.com/2012/01/26/a-peek-inside-the-ubot-malware-bot/</link>
		<comments>http://blog.webroot.com/2012/01/26/a-peek-inside-the-ubot-malware-bot/#comments</comments>
		<pubDate>Thu, 26 Jan 2012 19:18:09 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Backdoors]]></category>
		<category><![CDATA[Downloaders]]></category>
		<category><![CDATA[Keyloggers]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Passwords]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Trojans]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Malicious Software]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[Ubot Malware Bot]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5889</guid>
		<description><![CDATA[By Dancho Danchev Participants in the dynamic cybercrime underground ecosystem are constantly working on new cybercrime-friendly releases in the form of malware bots, Remote Access Tools (RATs) and malware loaders. Continuing the &#8220;A peek inside&#8230;&#8221; series, in this post I will profile yet another DIY (do-it-yourself) malware bot, available at the disposal of cybercriminals at [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5889&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/01/26/a-peek-inside-the-ubot-malware-bot/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/ubot_malware_bot_01.gif" medium="image">
			<media:title type="html">ubot_malware_bot_01</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/ubot_malware_bot_02.png" medium="image">
			<media:title type="html">ubot_malware_bot_02</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/ubot_malware_bot_03.png" medium="image">
			<media:title type="html">ubot_malware_bot_03</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/ubot_malware_bot_04.png" medium="image">
			<media:title type="html">ubot_malware_bot_04</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/ubot_malware_bot_05.png" medium="image">
			<media:title type="html">ubot_malware_bot_05</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/ubot_malware_bot_06.png" medium="image">
			<media:title type="html">ubot_malware_bot_06</media:title>
		</media:content>
	</item>
		<item>
		<title>Researchers intercept a client-side exploits serving malware campaign</title>
		<link>http://blog.webroot.com/2012/01/25/researchers-intercept-a-client-side-exploits-serving-malware-campaign/</link>
		<comments>http://blog.webroot.com/2012/01/25/researchers-intercept-a-client-side-exploits-serving-malware-campaign/#comments</comments>
		<pubDate>Wed, 25 Jan 2012 19:14:59 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Backdoors]]></category>
		<category><![CDATA[Downloaders]]></category>
		<category><![CDATA[Firefox]]></category>
		<category><![CDATA[Google Chrome]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[Keyloggers]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Passwords]]></category>
		<category><![CDATA[rootkit]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Trojans]]></category>
		<category><![CDATA[Adobe Acrobat]]></category>
		<category><![CDATA[adobe flash]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Exploits]]></category>
		<category><![CDATA[java]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[vulnerabilities]]></category>
		<category><![CDATA[Web Malware Exploitation Kit]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5872</guid>
		<description><![CDATA[By Dancho Danchev Security researchers from Webroot have intercepted a currently active, client-side exploits-serving malicious campaign that has already managed to infect 18,544 computers across the globe, through the BlackHole web malware exploitation kit. More details: The BlackHole Web malware exploitation kit is currently serving the following exploits: Java Rhino; Java OBE; MDA; PDF ALL; PDF LIBTIFF; [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5872&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/01/25/researchers-intercept-a-client-side-exploits-serving-malware-campaign/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/malware_campaign_client-side_exploits.png" medium="image">
			<media:title type="html">Malware_Campaign_Client-Side_Exploits</media:title>
		</media:content>
	</item>
		<item>
		<title>How phishers launch phishing attacks</title>
		<link>http://blog.webroot.com/2012/01/23/how-phishers-launch-phishing-attacks/</link>
		<comments>http://blog.webroot.com/2012/01/23/how-phishers-launch-phishing-attacks/#comments</comments>
		<pubDate>Tue, 24 Jan 2012 02:27:26 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[social engineering]]></category>
		<category><![CDATA[Passwords]]></category>
		<category><![CDATA[Online shopping threats]]></category>
		<category><![CDATA[spam]]></category>
		<category><![CDATA[phishing]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Phishing Attacks]]></category>
		<category><![CDATA[Phishing Campaigns]]></category>
		<category><![CDATA[Phishing Emails]]></category>
		<category><![CDATA[Phishing Framework]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5853</guid>
		<description><![CDATA[By Dancho Danchev Just like in every other industry, participants in the cybercrime ecosystem are no strangers to the concept of standardization. Standardization results in efficiencies, which on the other hand results in economies of scale. In this case, malicious economies of scale. Just how easy is it to launch a phishing attack nowadays? What tools, [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5853&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/01/23/how-phishers-launch-phishing-attacks/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_01.gif" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_01</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_02.png" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_02</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_03.png" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_03</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_04.png" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_04</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_05.png" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_05</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_06.png" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_06</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_07.png" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_07</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/phishing_framework_phishing_attacks_08.png" medium="image">
			<media:title type="html">Phishing_Framework_Phishing_Attacks_08</media:title>
		</media:content>
	</item>
		<item>
		<title>A peek inside the Umbra malware loader</title>
		<link>http://blog.webroot.com/2012/01/20/a-peek-inside-the-umbra-malware-loader/</link>
		<comments>http://blog.webroot.com/2012/01/20/a-peek-inside-the-umbra-malware-loader/#comments</comments>
		<pubDate>Fri, 20 Jan 2012 18:46:03 +0000</pubDate>
		<dc:creator>ddanchev</dc:creator>
				<category><![CDATA[Backdoors]]></category>
		<category><![CDATA[Keyloggers]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[Threat Research]]></category>
		<category><![CDATA[Trojans]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[Cybercrime Underground]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[Umbra Malware Loader]]></category>

		<guid isPermaLink="false">http://blog.webroot.com/?p=5837</guid>
		<description><![CDATA[By Dancho Danchev The thriving cybercrime underground marketplace has a lot to offer. From DIY botnet builders, DIY DDoS platforms, to platforms for executing clickjacking and likejacking campaigns, next to drive-by malware attacks, the ecosystem is always a step ahead of the industry established to fight back. Continuing the &#8220;A peek inside&#8230;&#8221; series, in this [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=blog.webroot.com&amp;blog=6518987&amp;post=5837&amp;subd=webrootblog&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
		<wfw:commentRss>http://blog.webroot.com/2012/01/20/a-peek-inside-the-umbra-malware-loader/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">ddanchev</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/umbra_malware_loader_01.png" medium="image">
			<media:title type="html">Umbra_Malware_Loader_01</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/umbra_malware_loader_02.png" medium="image">
			<media:title type="html">Umbra_Malware_Loader_02</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/umbra_malware_loader_03.png" medium="image">
			<media:title type="html">Umbra_Malware_Loader_03</media:title>
		</media:content>

		<media:content url="http://webrootblog.files.wordpress.com/2012/01/umbra_malware_loader_04.png" medium="image">
			<media:title type="html">Umbra_Malware_Loader_04</media:title>
		</media:content>
	</item>
	</channel>
</rss>
