Entirely new trojan quietly wheeled into black hat forums

An RSA researcher claims to have found an entirely new trojan during his trawls of the criminal underground.
RSA researcher Eli Marcus says the "Pandemiya" trojan comprises about 25,000 lines of fresh code. With most malware based on proven platforms, entirely new code is a rarity.

Pandemiya is nasty: it can steal data from forms, create fake web pages and take screen shots to send back to the botmasters who deploy it.
The software is modular and pervasive, and unique thanks to its ability to inject itself into all new processes via the Windows security registry function CreateProcess API.
It even has an upgrade path: Marcuswrites that a $US1,500 version offers basic functions but a $US2,000 cut allows .dll file plug-ins to enhance its functionality. A Facebook attack module is reportedly in the works.
"The advent of a freshly coded new trojan malware application is not too common in the underground," Marcus writes, adding that the modular approach means Pandemiya could become "more pervasive in the near future."

Pandemiya can also sign off botnet files, a trick Marcus that said helped prevent hijacking and analysis by cops and security bods. Dynamic encrypted communications help it to dodge network analysers.
Like other trojans, Pandemiya is foisted on machines through exploit kits and drive-by infections that target vulnerabilities in buggy wares such as Java, Silverlight and Flash.
Marcus speculated the trojan was relatively unknown until now due to its high price and new-kid-on-the-block status compared to the likes of Zeus and Citadel.
The good news is that Pandemiya can be removed with a little registry-tweaking and command line action.

CIA rendition jet was waiting in Europe to SNATCH SNOWDEN

As the whistleblowing NSA sysadmin Edward Snowden made his dramatic escape to Russia a year ago, a secret US government jet - previously employed in CIA "rendition" flights on which terror suspects disappeared into invisible "black" imprisonment - flew into Europe in a bid to spirit him back to America, the Register can reveal.

Mr Snowden, your ride is waiting. Click here for full size.

On the evening of 24 June 2013, as Snowden arrived in Moscow from Hong Kong intending to fly on to Cuba, an unmarked Gulfstream V business jet - tail number N977GA - took off from a quiet commercial airport 30 miles from Washington DC. Manassas Regional Airport discreetly offers its clients "the personal accommodations and amenities you can't find at commercial airports".
Early next morning, N977GA was detected heading east over Scotland at the unusually high altitude of 45,000 feet. It had not filed a flight plan, and was flying above the level at which air traffic control reporting is mandatory.
"The plane showed up on our system at 5:20 on 25 June," according to our source, a member of an internet aircraft-tracking network run by enthusiasts in the UK. "We knew the reputation of this aircraft and what it had done in the past."
N977GA was not reporting its progress to air-traffic controllers, and thus it would normally have been necessary to use a massive commercial or military radar installation to follow its path. But, even if pilots have turned off automated location data feeds, ordinary enthusiasts equipped with nothing more than suitable radio receivers connected to the internet can measure differences in the time at which an aircraft's radar transponder signal reaches locations on the ground. Using the technique of multilateration, this information is sufficient to calculate the transponder's position and so track the aircraft. (The ACMS/ACARS data feeds which automatically report an aircraft's position are a separate system from the transponder which responds to air-traffic radar pulses. They too can be picked up by receivers on the ground beneath, if they are activated.)
Several such online tracking networks are active in the UK, using this and other sources of information: they include www.flightradar24.com, www.planefinder.net, Planeplotter (www.coaa.co.uk/planeplotter.htm) and www.radarvirtuel.com. UK-based Planeplotter is one of the more sophisticated of these global "virtual radar" systems. It boasts 2,000 members with receivers hooked up to the internet.
The online tracking information reveals that the Gulfstream did not make it all the way to Moscow, but set down and waited at Copenhagen Airport.