A threat actor from Germany that goes by the handle Vicswors Baghdad appears to be behind the propagation of the Houdini malware on Pastebin sites—as well as actively editing an open source ransomware variant called MoWare H.F.D. According to Recorded Future analyst Daniel Hatheway, there have been three distinct spike in malicious Visual Basic scripts (VBScript) posted on paste sites, the majority of which are the Houdini worm.

Read full news article on Infosecurity