And even more Bagles

As the previous post says, there have been a lot of new Bagle modifications in the last 24 hours. And they’re continuing, either being spammed, or by previous versions downloading updates to themselves from the Internet. All of this frantic activity is aimed at maintaining the network of infected computers, by finding new victim machines, infecting them, and conscripting them into the network.

We’ve intercepted at least 20 new versions, and are now up to Bagle.dh. They are showing no signs of stopping at the moment.

As usual, our antivirus databases have been updated with detection for all the latest variants.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.