From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Creative graphic of robotic process automation at work (with a physical robot)

This botnet crashed itself thanks to a typo

Akamai Security Research wrote the KmsdBot botnet crashed almost entirely thanks to an error-check fail.

Botnet self-terminates thanks to typo

Billy Hurley

BlackBerry report says ‘no platform is safe’ (and that includes macOS)

Mac is not a safer platform, says BlackBerry in its latest report.

A laptop tracking vital signs is placed on rolling medical equipment. 

OpenSSL’s security team says two vulnerabilities are difficult to exploit.

OpenSSL flaws downgraded and patched after initial alarm

A USB drive with "not ransonware" written on masking tape with binary code floating above it in the form of a skull and crossbones

Malware

Brianna Monsanto

Like most teenagers in the early 2000s, Marcin Kleczynski spent a lot of time on the family computer.

The Kleczynski household was home to a white Dell CRT Monitor, the kind the Malwarebytes co-founder and CEO told IT Brew practically everyone had at the time. On it, he would play videogames that he obtained through “nefarious” means—until the clunky PC fell victim to 

, malicious software that caused a host of problems for the devices they occupied, such as slower performance and pesky pop-ups.

“Long story short, [I] downloaded what I thought was a video game to play and the computer starts acting funny,” he said.

“Here I am, in the basement of my parents’ house. We’ve got a computer for the first time, and I broke it,” Kleczynski said.

He quickly took to the internet to find a way to salvage his computer. Fortunately, a volunteer on a spyware-focused online messaging forum came to Kleczynski’s aid, supplying him with instructions to nurse his PC back to health.

“I decide I want to stick around this community because I saw her as a superhero online helping people like me clean up their computer for free,” Kleczynski said.

Kleczynski—who always had an affinity for computers, recalling one time during high school when he built a PC from scratch in front of his peers (“it wasn’t that hard,” he said)—quickly submerged himself in the spyware community, helping out others in need. During his time there, he realized that volunteer spyware warriors like himself were relying mostly on crowd-built resources.

“To me, that was a massive disconnect,” Kleczynski said, questioning why the online volunteers weren’t getting paid for their efforts and why they only had “hacked-together” tools to work with.

This prompted Kleczynski, along with a few colleagues he met within the makeshift spyware community, to launch Malwarebytes in 2008. He said part of what made the cybersecurity company so successful was that it acted as a “wing man” to the larger security companies.

“We would tackle the most aggressive threats, the ones that were most prolific, the ones that were affecting people in the harshest ways, and we would also work collaboratively with these message boards of people trying to help others, and [became] a tool for that superhero,” Kleczynski said.

He added that the company’s choice to provide its core services for free also distinguished it from other players in the industry.

“We were…giving the cure away for free and offering a vaccine for a nominal lifetime cost at the time,” Kleczynski said. “So, I think that’s really what set us apart.”

Alex Eckelberry was the CEO of security software company Sunbelt Software in the early 2000s, another company entrenched in the spyware space and a direct competitor of Malwarebyes at one point. Eckelberry spoke highly of the cybersecurity software company when reflecting on its role in the spyware epidemic.

“They were the best at removing stuff. They could remove anything, and the reason Malwarebytes was so good was because their technology was good, but they also came out of that community,” said Eckelberry, who later served as a general manager and board member of Malwarebytes.

While today, spyware may feel like a blast from the past, Malwarebytes is still up and kicking. The company claims it serves millions of customers around the globe and currently blocks more than 90 million web threats and malicious sites in a typical month.

Kleczynski attributes the company’s success to its move to separate its enterprise and consumer businesses. In 2023, Malwarebytes launched ThreatDown, a distinct rebranding of its Malwarebytes for Business solutions geared toward businesses, partners, and managed service providers.

“Businesses are worried about very different things than consumers and so to have the same product offering, go-to-market strategy, [and] website brand didn’t make much sense,” Kleczynski said. He added that while organizations tend to focus on things like network security, consumers are more interested in identity protection.

 Kleczynski said Malwarebytes sees an even amount of demand from the two customer segments. Right now, his focus is on the long-term strategy of the business as it comes of age.

“What do we want to be when we grow up after 18 years?” Kleczynski said. “I guess we’re a teenager as a company. It’s crazy.”

Marcin Kleczynski against a purple background with two white flowers.

How Malwarebytes CEO Marcin Kleczynski accidentally became the internet’s spyware defender

It all started with an old white Dell PC and pirated video games. 

Well, hello there! I don’t think we’ve been properly introduced. I’m Bonzi.

For some folks, the above may trigger memories of an animated purple gorilla that told the occasional joke and helped them surf the web. For others, those words may be a reminder of what felt like the beginning of the end for their computer.

In the early 2000s, spyware—malicious software, also referred to as adware, that collects information about a person without their consent—was as pervasive as velour tracksuits, scandalous tabloid magazines, and low-rise jeans.

“It was normal for almost everyone that was going to the internet to be at some point infected or annoyed by these things,” said Luis Corrons, a security evangelist at Gen.

BonziBuddy was arguably a poster child for early spyware programs. The intelligent software agent, which was free to download, masqueraded as an innocent tool that could assist users with basic tasks such as calendar reminders. However, the software would soon cause issues for users, like Malwarebytes co-founder and CEO Marcin Kleczynski, who downloaded the cartoon personal assistant for fun. Then it overstayed its welcome.

“It was very annoying,” Kleczynski said. “You could not get rid of it. You could not uninstall it very easily. It kept changing your browser settings. It kept feeding you advertisements. And at some point, I just didn’t know what to do.”

 over the years for deceptive ads and tracking underage users, was just a drop in the ocean of spyware that was being encountered by internet users. Alex Eckelberry, CEO of security software company Sunbelt Software in the early 2000s, recalled finding a slew of “garbage” spyware software on a neighbor’s computer as a result of her kids being on the internet.

“The browsers were not as secure as they were today and people could get tricked into installing stuff,” he said.

The malicious software also got a hold of more savvy computer users. Ben Edelman, who was a Harvard Law School student at the peak of the spyware craze, told IT Brew that spyware software often used deceptive tactics to attract victims.

“We found some where it would install even if you said no,” Edelman said. “The ‘I disagree’ or ‘I reject’ button wasn’t wired up properly, and it would still install.”

Edelman, now a founder of his own consulting firm, told us he was able to 

 in Internet Explorer 6, one of the most popular browsers at the time, that allowed malicious actors to run a security exploit allowing web pages to install software on a user’s computer without their consent.

“Everyone knew there was such a thing as a security exploit, but was anyone actually using the security exploits to install adware?” Edelman said. “Well, I proved that the answer [was] yes.”

For some users, spyware was a nuisance because it slowed down their machines. For others, the malicious programs posed a major privacy risk. Eckelberry in a 

 opined what he believed was the core problem with adware and spyware programs.

“It’s no longer your machine, it’s the advertisers,” Eckelberry wrote. “Is that bad? Is that wrong? Not necessarily. But our position is clear: The user needs to know that this stuff is on their system.”

By 2004, spyware had caused the internet to become the wild, wild west.

 conducted by AOL and the National Cyber Security Alliance that year found that 80% of the 329 dial-up and broadband adult computer users queried in its survey had spyware or adware installed on their computer and only 53% of those individuals were aware of it.

Initially, regular people took matters into their own hands to put a leash on the spyware plague. Eric Howes, now a threat analyst at KnowBe4, was one of them. At the time, Howes was an adjunct instructor by day and a spyware connoisseur on forums like Spyware Warrior by night.

“I wrote a number of long, long blog posts with screenshots illustrating how the software gets installed and so on and so forth,” he said.

Howes, who was later recruited by Eckelberry to work at Sunbelt, told us that people providing assistance to others during this time were largely volunteers.

“This is one of the interesting things about the fight against [spyware],” Howes said. “Until the Nortons and McAfees and what have you jumped in, it was really a grassroots effort that rose up to battle the scourge of adware and spyware.”

Howes told IT Brew that the online helpers even began to build their own tools to help ward off spyware on infected devices.

Edelman was an early spyware defender on the frontlines. He told IT Brew that he began writing profusely about the matter after providing an expert declaration in a lawsuit against Gator, 

“I think I dropped a new article every Monday,” Edelman said. “I called it the ‘Misleading installation of the week.’”

While security companies were “asleep at the switch,” Edelman said he willingly took on the brunt of exposing large adware and spyware players, even if it had legal implications.

“I didn’t mind the risk of someone suing me because I knew that I was in the right,” Edelman said. “I knew I could prove it.”

Small security firms also stepped up to the plate. Eckelberry said that Sunbelt, a small Tampa Bay, Florida-based company, became a “national name” because of its role in helping to fix infected devices, while also educating the public through its blog. Sunbelt was acquired by GFI Software in 2010.

“The antivirus companies—Trend, McAfee, Symantec—they were caught flat footed,” Eckelberry said. “They did not have the technology to deal with this.”

Eckelberry added that Malwarebytes, formed by Kleczynski in 2008, was a notable player at the time.

“They were the best at removing stuff,” Eckelberry, a former board member of the cybersecurity company, said. “They could remove anything.”

 Edelman said that the legacy security vendors eventually “woke up to the work that their users expected them to do.”

“Both Symantec and McAfee began providing excellent protection against adware. Microsoft began building it right into Windows,” Edelman said. “Windows Defender comes with every copy of Windows to this day.”

He added that his blog posts, which included analyses of how companies like 

, helped to expose advertisers who used inappropriate advertising practices and made it harder for them to stay in business.

“Some of these companies, when they saw what I wrote up on my website, they were horrified,” Edelman said.

Roughly two decades later, Howes said the practices of the adware industry have been “ubiquitous” in today’s world, as internet users now expect some form of surveillance and data gathering when they go online.

“All the big social media programs are built on that business model: privacy, invasive data gathering, and monetization of that privacy,” he said.

However, the security professional still thinks fondly of the work he and others have done to protect users in the early days of the internet.

“In the rear-view mirror, some of the battles that we fought—Alex and Ben and I and plenty of other people—look a little quaint right now, which does not mean that I have doubts about the justice of the fights that we did,” Howes said. “I still feel very good about what we did.”

Desktop virtual assistant Bonzi Buddy. (Credit: Bonzi Buddy)

How BonziBuddy, a purple talking gorilla, took spyware mainstream

Before there was Siri, Alexa, and Cortana, there was BonziBuddy.

How a purple talking gorilla took spyware mainstream

Some “elusive” threat actors are putting on their best button-down shirts and pajama pants and getting ready for a call with the CEO.

, cybersecurity research and consulting firm Trail of Bits detailed how a crypto-stealing threat group known as Elusive Comet targeted an exec with a scheme involving a media opportunity, a Zoom call, and a pushy request to share their screen.

“The Elusive Comet campaign represents the continuing evolution of threats targeting operational security rather than technical vulnerabilities. As we’ve entered the era of operational security failures, organizations must evolve their defensive posture to address these human-centric attack vectors,” the Trail of Bits team wrote in the conclusion of their analysis.

An unnamed CEO, according to Trail of Bits, received an invitation from two separate X accounts to appear on a “Bloomberg Crypto” video series. The Elusive Comet actors refused to connect through email, instead sending a Calendly invite.

The primary attack vector called for Zoom’s legitimate remote-control feature—one an IT professional may employ to control another user’s computer and 

The group used the forged name “Zoom,” so the target received a notification saying: “Zoom is requesting remote control of your screen.” With the alias, the pop-up looked like a system notification.

If granted access, the group can install malware, exfiltrate data, or conduct cryptocurrency theft.

Elusive Comet is responsible for “millions of dollars in stolen funds” according to a 

 calculated $9.3 billion in cryptocurrency fraud costs for 2024—a year over year increase of 66%. Screensharing ruses 

Chris Pierson, CEO of BlackCloak, a company offering executive-level cybersecurity protection, recommends companies educate employees about the tools allowing system-level access, and the patterns of social-engineering attacks targeting such access.

“Making sure that you have not a 20-person IT and security team, but a 2000- [or] a 20,000-person IT and security team is absolutely critical,” Pierson said, also recommending IT pros provide the “least access” privileges possible, within the settings of a given tool.

Trail of Bits had a number of recommendations in its post, including deploying its own scripts to prevent accessibility options. The firm also advised companies to create policies for media appearances, deploy email-security tools that also monitor calendar invites, and train staff to recognize unusual permission requests during video calls.

“Zoom takes the security and privacy of its users very seriously, and a user must always provide explicit consent before allowing another participant to take control of their screen using the remote control feature,” Zoom spokesperson Colleen Rodriguez wrote in a statement shared with IT Brew, referring readers to 

Crypto thieves join the Zoom

 If granted access, threat actors can install malware and exfiltrate data.

 detailed a sharp increase in open-source malware that targets developers, “smash and grab” style, and exfiltrates data from their code environments.

According to Brian Fox, co-founder and CTO at Sonatype, developers are getting tricked into downloading malicious software packages. The package then executes code that gathers details like API passwords, session cookies, and test databases, and ships them to a destination.

“It’s over in a flash,” Fox said. “Many of the times, people don’t recognize that this was even an attack.”

Sonatype, a software supply-chain management company, claims in its recent study:

Over one half (56%) of malware discovered in Q1 2025 involved data exfiltration, “designed to collect sensitive information from infected systems.”

In Q4 2024, data exfilitrators made up just 26% of open-source malware—what the company defines as malicious code “intentionally crafted to target developers in order to infiltrate and exploit software supply chains.”

The data-exfiltration attacks are frequently a “spear phishing attack on developers,” according to Fox, appearing via a fake listing on public repositories of software components. Maybe a malicious component’s file name uses an underscore instead of a legitimate component’s hyphen.

“The attackers fake the number of downloads. They fake the stars so it can look as legit as the original one, because there’s not enough awareness. [Developers] are not yet trained to be skeptical,” Fox told us.

Threat actors can do plenty with data smashed and grabbed from a developer environment. An 

 acts as an entryway to an application and its valuable data.

According to Fox, threat actors are targeting small but valuable pieces of data—like a retailer’s repo of hashed passwords or a browser’s cache of cookies—to help adversaries access bank accounts.

“They’re breaking into the janitor’s closet, not to put in a bomb, but to grab his keychain, and then they’re going to come back at night with the keychain,” Fox said.

The report cited early incidents from 2025:

Hijacked packages on JavaScript code-sharing tool npm contained malware that collected “sensitive information from the target system environment such as environment variables”—components that Sonatype noted often store valuable 

A counterfeit npm extension installed info-gathering spyware and enabled “full remote control.”

Malicious packages targeted crypto developers with Windows trojans capable of keylogging and data exfiltration. (These packages were downloaded over 1,900 times collectively, the report said.)

, claimed an 156% year over year growth in open-source malware, citing 512,847 malicious packages—not just data exfiltrators but a full array of malware—since October 2023.

Binary code being enlarged by a digital magnifying display.

Data exfiltrators stand out as open-source malware rises

 And developers aren’t trained to be skeptical, according to one software pro.

It sounds like another Vin Diesel movie, but that’s not why agencies around the world are warning of a new “fast flux” threat.

 from six cyber orgs, including the NSA, CISA, and Canadian Centre for Cyber Security (CCCS), urged cyber pros and ISPs to collaborate against a dodgy tactic that’s dodging detections.

If the Domain Name System (DNS) is the internet’s phonebook, translating dot-com domains into the numbered IP addresses that computers understand, think of “fast flux” as a way for threat actors to call home from different numbers.

Malicious cyber actors, including cybercriminals and nation-state actors, use the flux to change IP addresses and “obfuscate the locations of malicious servers,” the advisory began.

“This technique poses a significant threat to national security, enabling malicious cyber actors to consistently evade detection,” CISA wrote in its April 3 advisory.

Some malware calls back to a domain (“ransomware dot com,” let’s say), signaling a successful compromise to a domain’s 

, or C2, server. Security researchers monitoring network traffic can block a malicious IP or domain if they notice infected hosts calling back to that server.

Fast flux, however, offers a moving-target challenge for IT pros, John Paul Cunningham, chief information security officer at identity-security company Silverfort, said.

“How can you block an IP that’s constantly rotating or changing? You can’t,” he told us.

In a “single flux” attack, according to the cross-agency memo, one domain is linked to numerous IP addresses, rotated as frequently as “every 5 minutes.” “This setup ensures that if one IP address is blocked or taken down, the domain remains accessible through the other IP addresses,” the report said.

Security researchers who spoke with IT Brew could only guess why the agencies would warn of a decades-old cyber tactic used by ransomware groups like Nefilim and Hive (

 in 2022 after amassing over $100 million in ransomware payments).

Nick Hyatt, senior threat intelligence analyst at cybersecurity advisory GuidePoint Security, estimates that the warning coincides with an expanding of operations for cybercriminals—threat actors moving on from specific targeting to “larger swathes of victims” requiring a larger infrastructure.

“One thing that does trend within cybersecurity is that everything old is new again. This is an established technique that works and then can be used by these threat actors to mask that infrastructure,” he said.

The joint advisory called out a category of providers known as bulletproof hosters who “promote fast flux as a service differentiator that increases the effectiveness of their clients’ malicious activities.”

While the joint advisory offered additional recommendations like blocking known bad addresses and implementing anomaly detection systems for DNS query logs that show frequent IP address changes, Hyatt sees the problem that not just the IT pro can solve.

“It’s something that really has to be solved at the provider level, rather than something that just an end user in an organization can do,” Hyatt said.

Agencies warn of ‘fast flux’ cyber threat

 For IT pros and hosting providers, it’s time to whack some moles.

 from cybersecurity company Group-IB shows that cybercriminals have been using phony trading apps to swindle unsuspecting individuals as part of a global “pig butchering” campaign.

Pig butchering is a form of investment fraud where scammers persuade their victims into making large investments on fake trading platforms. The scheme—which is commonly associated with cryptocurrency and is surprisingly vegan-friendly—refers to how scammers build trust with their victims before later draining them of their investments. The ruse has proven to be a lucrative cyber threat, with researchers from the University of Texas at Austin 

 that pig butchering scammers have stolen more than $75 billion from victims in the last four years.

Since May, Group-IB analysts have identified several fake mobile applications that have been disguised as trading platforms on the Google Play and Apple App Store, and used as part of the global scheme. The cybersecurity company, which was founded in Russia but shifted its headquarters to Singapore in 2019, has classified the fraudulent apps as members of the UniShadowTrade malware family and said the mobile applications were built using the UniApp Framework.

While Group-IB was unable to pinpoint how cybercriminals are going about targeting their pig butchering victims, the report suggested it is most likely through social engineering tactics on dating and social networking platforms. After building a relationship with their victims, malicious actors are then able to convince them to download seemingly legit applications to execute their crime.

One example of a fake app discovered by Group-IB deceived users with a description that claimed it could be used for “algebraic mathematical formulas and 3D graphics volume area calculations.” Users who downloaded the app were prompted to make an account and disclose sensitive information, before being instructed to make a deposit. The cybercriminal is then able to convince the victim to continue investing money on the platform, which they are unable to withdraw.

The app has since been removed from the App Store, but Group-IB claims that cybercriminals have continued to circulate it to both Apple and Android users through phishing websites.

Another bogus app discovered by Group-IB on the Google Play Store masqueraded as an application that shared stock-related news. The app racked up more than a thousand downloads before being removed by the app store.

Group-IB claims it was able to identify pig butchering victims across the Asia-Pacific, European, and Middle East and Africa regions.

 The recently discovered tactic joins the slew of strategies malicious actors are using to perform 

. IT Brew has previously reported that cybercriminals are also sending their victims to their 

 the web pages of common retail brands as part of their crypto fraud gambits.

Hackers, Malware, fake trading apps, fake investing apps

Hackers are using fake trading apps to entice their next ‘pig butchering’ victim

The apps were classified as part of the UniShadowTrade malware family by Group-IB. 

Like snowflakes, agents, and K in the cereal aisle, every malware is special—lately at least.

Software company BlackBerry, in its quarterly report of cyberattacks from April to June 2024, noticed an average of 11,500 unique malware samples per day, a 53% jump and “one of the highest percentage increases, quarter over quarter,” since the software company began its Global Threat Intelligence reports in January 2023.

You might expect AI to be behind such massive production, but BlackBerry’s lead researcher says the steep increase demonstrates that the ransomware-as-a-service (RaaS) market—and a core piece of it known as the ransomware builder—is alive and well.

“Having been in the industry for 24 years, I’ve never seen so much availability of these builders and so much knowledge on how to create malware,” Ismael Valenzuela, VP of threat research and intelligence at BlackBerry, told IT Brew.

A software tool known as a ransomware builder, Valenzuela said, features user-friendly interfaces to help even a programming novice create customized payloads and adjust ransomware aspects like personalized messaging, ransomware amounts, and encryption methods. Each customization creates an official signature, or hash, which a signature-based antivirus tool aims to find.

“Somebody is putting in the effort to craft all of these different customizations in the tool; they click on ‘generate’ and that generates a new payload. Every time you do that, it’s going to generate a new hash. The more builders available out there, the more hashes we’re going to find out in the wild,” Valenzuela said (The builders, he added, are an essential aspect of the ransomware-as-a-service ecosystem, where creators offer the ransomware in exchange for a cut of the profits.)

The average cost of a ransomware attack, according to IBM’s recent Cost of a Data Breach report, which studied global incidents between March 2023 and February 2024? $4.91 million.

Additionally, compilers, when they pull in open-source code, introduce a level of randomness to the output, according to Valenzuela, which means a unique code and a unique hash associated with it.

A report from cybersecurity company Darktrace declared malware-as-a-service (MaaS) “the most observed threat type” affecting its customers during the second half of 2023, and that both MaaS and RaaS “represent the majority of malicious tools across the cyber threat landscape.”

Darktrace highlighted “cross-functional adaptation of many malware strains, such as remote access trojans (RATs) and information-stealing malware,” thanks to the use of open-source repositories and leaked code.

The uniqueness challenges endpoint protection capabilities that rely on signature detection.

“You cannot just defend based on traditional, signature based endpoint [security], or based on blocking lists,” Valenzuela said, who recommended security strategies like network segmentation and least privilege access to defend against a rise in one-of-a-kind malware.

Digital skull and crossbones on the facade of a building