Sobig.c celebrates anniversary

It’s two years to the day since the email worm Sobig.c caused a major epidemic.

In 2003, worms from the Sobig family were the most widespread malicious programs on the Internet. Sobig’s family tree dates back to January 2003, when Sobig.a was first detected. Sobig.a was a piece of malware using many techniques which would be exploited by other virus writers in the future.

Firstly, something that Sobig.c clearly demonstrated was that spamming malware can create an epidemic. The virus sent itself to millions of addresses around the world in a matter of hours, and spammer technology made this possible. Such techniques are now used by almost every virus writer and Trojan author to distribute their creations. Essentially, the criminal alliance between virus writers and spammers came into being with Sobig.c

Secondly, worms from the Sobig family had a limited life span – they were designed to function for two or three weeks, and then a new version would be released to take its place. Mydoom and Sober worms also use this approach.

Thirdly, Sobig.c infected millions of computers throughout the world, creating an enormous botnet, which was then used to launch new versions of the worm. One of these, Sobig.f was the first case in virus history where a price was placed on the author’s head – Microsoft offered half a million dollars for information leading to arrest of Sobig.f and Lovesan’s authors. The money remains unclaimed to this day.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.