Doron Voolf
Malware Analyst
Working at F5 for 5 years, Doron handles and analyzes cyber threat investigations for most of the major banking malware families in recent years. Doron holds a Bachelor of Science focused in Computer Science.
Research by Doron Voolf (16)
Article | Jun 11, 2020
Qbot Banking Trojan Still Up to Its Old Tricks
The Qbot banking trojan is back, targeting American banks with dedicated campaigns followed by stealth and evasion techniques.
6 min read
Article | Apr 24, 2020
Mirai “COVID” Variant Disregards Stay-at-Home Orders
New Mirai variant references the COVID-19 pandemic with a filename change and two targets: Huawei routers and TeamSpeak.
7 min read
Article | Dec 26, 2019
Gafgyt Targeting Huawei and Asus Routers and Killing Off Rival IoT Botnets
IoT botnet Gafgyt targets popular routers through RCE vulnerabilities, and even removes competing malware.
7 min read
Article | Sep 17, 2019
Tricky Trickbot Runs Campaigns Without Redirection
Known for redirection attacks, recent Trickbot banking trojan campaigns use server-side injection and target fewer victims.
8 min read
Article | Jun 18, 2019
Gootkit Italian Campaign Overview
The Gootkit banking trojan is still active and protecting itself in Italy using a dedicated redirection defense.
2 min read
Article | Dec 17, 2018
DanaBot November Campaigns Target European Banks and Email Providers
First detected in May 2018, DanaBot is a fraud trojan that has since shifted its targets from banks in Australia to banks in Europe, as well as global email providers such as Google, Microsoft and Yahoo for the holiday phishing season.
6 min read
Article | Jun 29, 2018
BackSwap Defrauds Online Banking Customers Using Hidden Input Fields
BackSwap demonstrates unique behavior in its manipulation of user input fields and its handling of International Bank Account Numbers (IBANs).
6 min read
Article | May 9, 2018
Panda Malware Broadens Targets to Cryptocurrency Exchanges and Social Media
Panda malware is back in full force with three currently active campaigns that extend its targets beyond banking to new industries and organizations worldwide.
9 min read
Article | Jan 15, 2018
Ramnit Goes on a Holiday Shopping Spree, Targeting Retailers and Banks
Ramnit’s latest twist includes targeting the most widely used web services during the holidays: online retailers, entertainment, banking, food delivery, and shipping sites.
10 min read
Article | Sep 14, 2017
Trickbot Rapidly Expands its Targets in August, Shifting Focus to US Banks and Credit Card Companies
TrickBot kicked into high gear coming into August with the most targeted URLs since its launch. It released a new worm module, shifted its focus towards the US, and soared past the one thousand target URL mark in a single configuration.
13 min read
Results 1-10 of 16
Stay up to date with F5 Labs
Get the latest threat intelligence and research delivered to your inbox.