News from the Mobile Front

The first quarter of 2006 marks a turning point in mobile malware development. The era of quantitative development, with its numerous, but primitive Trojans for Symbian OS has ended. The quality of mobile malware has changed visibly.

Let’s consider a chronological list of mobile viruses that appeared in early 2006:

• Trojan-SMS.J2ME.RedBrowser
• Worm.MSIL.Cxover
• Worm.SymbOS.SteelWar
• Email-Worm.MSIL.Letum
• Trojan-Spy.SymbOS.Flexispy
• Trojan.SymbOS.Singlejump
• Trojan.SymbOS.Rommwar
• Trojan.SymbOS.Arifat

What does the list show us?

We see that writers of mobile malware have begun to use new programming languages: .NET (“.MSIL.”) and Java (“.J2ME.”).

Moreover, a new fashion seems to be emerging: a bias towards cross-platform viruses. For example, Worm.MSIL.Cxover, infects mobile devices that can be accessed via ActiveSync when it is executed on a PC. Yet it also infects the PC using the same mechanism when launched on a mobile device.

Then we have Trojan-Spy.SymbOS.Flexispy: a commercial Trojan that collects information about phone calls and SMS messages. Of course, it is only one example, but it is enough to show that the industry of mobile viruses has at last made headway into commerce on the one hand and into spying on the other.

And I think this is just a beginning.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.