Google

Recently, there’s been a lot of attention paid to different projects designed to use Google to find malware on the Internet. These projects use methods which have advantages and disadvantages. For instance, it’s well known that Google doesn’t index everything (yet) and malware authors can simply use the robots file to tell Google not to index their creations. On the other hand, it’s a very cost effective way of obtaining infection statistics and samples.

Over the past year, we’ve been working on a couple of new projects here at Kaspersky Lab, to help us get a better view of what malware is available on the Internet. For instance, during January we ran a massive scan of the Romanian web space.

It’s probably no surprise to anyone that exploits, especially IE-related ones, top the malware charts.

We’ll publish a few more detailed results from these projects in the near future, including our scans of the Dutch and Brasilian web space. At the same time, it will be interesting to see if Google will take any precautions to prevent people from using it to find malware.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.