Stardust

I came across something interesting today: a macro virus which we’ve named Virus.StarOffice.Stardust.a

You might wonder what’s interesting about this – viruses have been around for a long time, and are starting to fade from the scene.

But if you look more closely at the name, you can see why I’m interested: Stardust is a macro virus written for StarOffice, the first one I’ve seen. Macro viruses usually infect MS Office applications.

Stardust is the first virus I know of which is theoretically capable of infecting StarOffice and/ or OpenOffice. It’s written in Star Basic. It downloads an image file (with adult content) from the Internet and then opens this file in a new document.

We’ll have a description of it in the Virus Encyclopaedia soon.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.