Kaspersky Lab Virus Analyst Summit (VAS)

A full week before the G8 summit begun in St. Peterburg, Kaspersky’s own Virus Analyst Summit – the fourth edition – took place in Moscow, at the company’s new office.

As we’ve mentioned before, this event takes place a couple of times a year. It gives the KL international team of virus analysts from France, the Netherlands, the US, Romania, Russia and UK a chance to meet and swap ideas.

This time we had a couple of new participants – Magnus (left), who’s working out of the German local office, and Claudiu (right), who I work with in Bucharest. They’re going to be part of our blogging team, as well as doing all the other things that we analysts do.

And as for what we actually do – well, there were lots of chances to discuss this. The summer 2006 summit included a crash course from Magnus in forensics, Shane’s presentation on the deployment and development of honeypots, a discussion with Denis and Nikita on breaking long RSA keys, and David’s vision of user education. And of course, there was time for less formal information swapping – the breaks were spent gazing into the future while enjoying a cup of tea and brownies.

We’re already looking forward to the next summit. Maybe we bring extremes of temperature with us, or maybe there are only two types of weather in Moscow – white and green. Last time we met it was – 30; this time it was +30. It’ll be interesting to see what new developments there are in malware evolution and climate change by the next time we meet.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.