Online Scanner Top Twenty for December 2006

Position	Change in position	Name	Percentage
1.	+19	Trojan.Win32.Dialer.cj	14.56
2.	+7	Trojan.Win32.Dialer.hz	10.27
3.	New!	Net-Worm.Win32.Mytob.c	7.92
4.	New!	Email-Worm.Win32.Warezov.et	6.80
5.	+5	Email-Worm.Win32.Rays	5.27
6.	New!	Email-Worm.Win32.Mydoom.m	3.66
7.	New!	Trojan.Win32.Dialer.a	3.27
8.	New!	Trojan-Downloader.Win32.Tiny.bm	3.08
9.	-2	Email-Worm.Win32.Brontok.q	3.03
10.	-7	Trojan.Win32.Dialer.hh	2.51
11.	New!	Email-Worm.Win32.Bagle.gt	2.35
12.	Return	Trojan.Win32.Agent.vg	2.22
13.	New!	Trojan-Downloader.Win32.Small.dam	2.10
14.	New!	Trojan-Downloader.Win32.Tiny.fb	2.08
15.	New!	Trojan.Win32.Dialer.on	1.59
16.	New!	Email-Worm.Win32.Warezov.fb	1.46
17.	New!	Trojan.Win32.Dialer.qi	1.24
18.		Trojan-Downloader.Win32.INService.gen	1.22
19.	-2	not-a-virus:PSWTool.Win32.RAS.a	1.20
20.	New!	Email-Worm.Win32.Scano.bk	1.16
Other malicious programs	84.91

December reinforced the unexpected trend of Trojan dialers appearing in the online Top Twenty. In November four such programs made it to our rankings, in December their number grew to six. In November the most successful of these programs took the second and third positions; in December these were replaced with others, which rose to the first and second places. In November we explained the way such Trojans operate, so we will not discuss them at length here. We will only mention that a few days ago the news came that several developers of such malicious programs, which mostly circulated in 2003-2004, have been jailed in Germany. Apparently, this illegal method of making money remains quite popular among cybercriminals.

Surprisingly, the third position was taken by the Mytob.c worm. Until now, it has been a regular feature on our email Top Twenty, but this is the first time it has made it to the online charts. This will become less surprising, however if you notice that seven more worms are present in the online Top Twenty statistics. Many of these have also been detected and monitored in the email traffic for a long time, but December was a début of sorts for them in the online statistics. They include Mydoom.m, Warezov.et and Scabo.bk. The newcomers to December’s email Top Twenty, Bagle.gt and Warezov.fb, are also present in the online charts. And, of course the Rays and Brontok worms just won’t give up.

The third most popular category in our online statistics, after dialers and worms are Trojan downloaders. In previous months representatives of this class, such as Delf.awg, took up leading positions. There are fewer of them in December’s rankings, but two Trojans from the Tiny family are present. This name is new to our statistics and we will be sure to follow the fate of these malicious programs in the coming year.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.