Friday, February 12, 2010

Singapore Boleh... Trojan connect to SG IP

Recently, there are several newly detected malicious PDF files that exploited Adobe Reader and execute backdoor trojan on victim's system. These trojans allow remote access from and Many will think that those hosts were likely to be from China or Russia, the usual suspect.

But both hostname are resolved to, which is in Singapore. The IP belongs to "NewMedia Express Pte Ltd, Singapore Web Hosting".

Whois record

Likely that NewMedia server was compromised to host and re-direct the traffic to the real hacker's address.

More details from F-Secure blog