Media Coverage

Shadowserver in the news

Trend Micro sponsors botnet fighter Shadowserver with $600,000

Security.NL, May 27, 2020

Antivirus company Trend Micro will sponsor the Shadowserver Foundation, a non-profit foundation registered in the Netherlands and the United States that works to combat botnets and cybercrime, with a total of $ 600,000 over the next three years. The foundation collects large amounts of information about botnets, malware and other criminal networks and shares it with providers and government services, such as Computer Emergency Response Teams (CERTs). The foundation can continue to exist thanks to all kinds of sponsors

Securing the Connected World with Support for The Shadowserver Foundation

Trend Micro, May 27, 2020

If the first few months of 2020 have taught us anything, it’s the importance of collaboration and partnership to tackle a common enemy. This is true of efforts to fight the current pandemic, and it’s also true of the fight against cybercrime. So when we heard that one of these partners, the non-profit Shadowserver Foundation, was in urgent need of financial help, we didn’t hesitate to step in. Our new $600,000 commitment over three years will help to support the vital work it does collecting and sharing global threat data for the next three years.

Shadowserver, an Internet Guardian, Finds a Lifeline

Wired, May 27, 2020

THE INTERNET SECURITY group Shadowserver has a vital behind-the-scenes role; it identifies online attacks and wrests control of the infrastructure behind them. In March, it learned that longtime corporate sponsor Cisco was ending its support. With just weeks to raise hundreds of thousands of dollars to move its data center out of Cisco’s facility—not to mention an additional $1.7 million to make it through the year—the organization was at real risk of extinction. Ten weeks later, Shadowserver has come a long way toward securing its financial future. On Wednesday, the IT security company Trend Micro will commit $600,000 to Shadowserver over three years, providing an important backbone to the organization’s fundraising efforts. The nonprofit Internet Society is also announcing a one-time donation of $400,000 to the organization.

Digital Realty’s California Data Centre Supports Non-Profit Internet Security Organisation

Data Economy, May 19, 2020

Digital Realty has reached an agreement with The Shadowserver Foundation to support the foundation’s data centre infrastructure needs at Digital Realty’s facility in Oakland, California. The Shadowserver Foundation, a non-profit security organisation working to make the internet secure, launched a search for a data centre provider offering the footprint, connectivity and flexibility needed to support its growing collection, processing and analysis of critical internet security data that help businesses safeguard operations.

Digital Realty welcomes Shadowserver Foundation to its Oakland data center

Data Center Dynamics, May 19, 2020

Digital Realty will be housing the non-profit Internet security analysts The Shadowserver Foundation at its Oakland data center, California. The Foundation had been looking for a new data center that could support its growing storage needs and allow it to be “independent”. By locating at the data center, Shadowserver will have easier access to Silicon Valley and enjoy enough space to support high-density deployments.

Digital Realty's Network Hub Solution to Support The Shadowserver Foundation in Bolstering Internet Security

PR Newswire, May 18, 2020

Digital Realty (NYSE: DLR), a leading global provider of data center, colocation and interconnection solutions, announced today it has reached an agreement with The Shadowserver Foundation to support the foundation’s data center infrastructure needs at Digital Realty’s facility in Oakland, California

Analyzing Encrypted RDP Connections

Security Boulevard, May 13, 2020

Microsoft’s Remote Desktop Protocol (RDP) is used to remotely administer systems within Windows environments. RDP is everywhere Windows is and is useful for conducting remote work. Just like every other remote administration tool, RDP can be used for legitimate or malicious control of a computer and is used by administrators and attackers alike for command and control of a remote system. Financially motivated attackers aren’t the only classes of threat making use of RDP, however. RDP services are also a vector of attack for advanced offensive groups like APT39 and APT40. Discovered in January of 2020, the Trickbot malware family added a new module, rdpScanDll, giving the malware the capability of credential bruteforcing. Wormable exploits like BlueKeep, DejaBlue, and BlueGate plague RDP servers across the Internet. Shodan recently identified an increase in publicly exposed RDP services on the Internet, a measure which Shadowserver and Kaspersky also monitor.

International Partners - Shadowserver

CSIRT.CY, April 30, 2020

The operations of the National Computer Security Incident Response Team of Cyprus (National CSIRT-CY) are vital for the secure functioning of the state and its economy. One of the most valuable operations of National CSIRT-CY which contributes greatly to proactive security is the processing of threat intelligence, daily reports and feeds received by external sources concerning current threats and malicious internet activity. One such external source is Shadowserver, a platform which provides valuable information and insights relating to emerging security threats. The main goal of the Shadowserver Foundation is to foster collaboration and to contribute to a culture in which the cybersecurity industry delivers ever greater service and capability. Shadowserver collaborates with major organizations such as Europol’s European Cybercrime Centre (EC3), Trend Micro, and the European Organization for Nuclear Research (CERN). Shadowserver is one of National CSIRT-CY’s primary threat intelligence sources. Close collaboration with the Shadowserver Foundation offers valuable operational intelligence enhancement. This puts National CSIRT-CY on the map of organizations and other entities which share the privilege of using Shadowserver’s services.

Botnet Designed to Mine Virtual Currency Shut Down

Bank Info Security, April 24, 2020

VictoryGate, a recently discovered botnet that infected about 35,000 devices with malware, has been disabled by researchers from security firm ESET. The botnet was designed to mine for the virtual currency monero, according to ESET analysts. It’s one of several recently discovered botnets that mine for cryptocurrencies other than bitcoin. The botnet mainly targeted victims in South America, with Peru accounting for about 90 percent of all infected endpoints, according to the report. ESET is working with No-IP and the nonprofit Shadowserver Foundation, which researches and tracks botnets, to notify victims and help clean devices of the VictoryGate malware.

ESET takes down VictoryGate cryptomining botnet

ZDNet, April 23, 2020

ESET announced today that it took down a malware botnet that infected more than 35,000 computers. The botnet’s primary purpose was to infect victims with malware that mined the Monero cryptocurrency behind their backs. ESET reported and took down the botnet’s command and control (C&C) server and set up a fake one (called a sinkhole) to monitor and control the infected hosts. The company is now working with members of the Shadowserver Foundation to notify and disinfect all computers who connect to the sinkhole.