Displaying items by tag: ServHelper

The security firm Deep Instinct claims to have found a third variant of the ServHelper Windows malware that is being distributed by the threat actor TA505 and uses an Excel 4.0 macro Dropper, a legacy mechanism still supported by Microsoft Office, to spread.

The threat actor TA505 has started to distribute a new Windows backdoor named ServHelper, according to email security firm Proofpoint. The company claims there are two variants, one directed at remote desktop functions and the second which is primarily a downloader for a remote access trojan known as FlawedGrace.