ID: IRCNE2014012065
Date: 2013-01-12
According to "cnet", the cybercriminals who infected the computers of European Yahoo users apparently wanted to create a huge Bitcoin network.
Researchers at security firm Light Cyber revealed this week that one of the malware programs aimed to use the resources of infected PCs to perform the calculations necessary to run a Bitcoin network. Reported earlier this month by fellow security firm Fox IT, the campaign spread its package by using Yahoo's ad server to deploy malicious ads. The malware took advantage of vulnerabilities in Java to install itself on computers that visited the ads.yahoo.com site.
The malware attack reportedly lasted from December 31 through January 3, when Yahoo took down the malicious ads. On Saturday, Yahoo acknowledged the issue through the following statement:
At Yahoo, we take the safety and privacy of our users seriously. On Friday, January 3 on our European sites, we served some advertisements that did not meet our editorial guidelines, specifically they spread malware. We promptly removed these advertisements. Users in North America, Asia Pacific and Latin America were not served these advertisements and were not affected. Additionally, users using Macs and mobile devices were not affected.
People with infected computers are advised to run a full virus scan and block the Internet domains listed above through their router/firewall.
Communication with the following Internet domains/IP addresses is an indication of a possible infection:
- blistartoncom.org
- doesexisted.in
- formsgained.in
- funnyboobsonline.org
- goodsdatums.in
- locationmaking.in
- mejudge.in
- operatedalone.in
- original-filmsonline.com
- preferringbad.in
- savedesiring.in
- slaptoniktons.net
- slaptonitkons.net
- stopsadvise.in
- yagerass.org
- 192.133.137.100
- 192.133.137.247
- 192.133.137.56
- 192.133.137.59
- 192.133.137.63
- 193.169.245.74
- 193.169.245.76
Relates Link:
Yahoo serves malicious ads
- 2