New Mytobs, and generic detections

We’ve been seeing a lot of new Mytob variants recently. It’s less than three months since we added detection for Mytob.a and already we’re well into double figures. In the last day or so we’ve added detection for Mytob.au (and there’s a lot of Mytob.au out there!), Mytob.av and Mytob.aw. If it were not for generic signatures, there would be a lot more!

Generic detection lets us detect multiple variants of the same malware family using a single virus definition … sometimes tens or even hundreds of threats! The use of hundreds of unpackers within the Kaspersky® antivirus engine has the same effect: re-packed variants are often detected without the need for a new definition.

The down side is that the suffix used to identify some new threats may not match that used by other antivirus vendors. This is especially true for ‘successful’ threats that spawn large numbers of variants.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.