Virus writers fear no retribution

We’ve been continuing to investigate the Bagle situation – and it shows us once again how helpless legislation is in the face of cyber crime. At the moment, cyber-crime laws are local, and are specific to individual countries. But virus writers aren’t constrained by national boundaries.

So what has this got to do with Bagle? It’s become clear to us that the authors of Bagle, Netsky, Zafi and a whole range of other malicious programs are working closely together. They may not know each other personally, but they’re all using information from the author of Bagle to send out their creations. In just the past two days, over 50 modifications of worms and other malicious programs have been widely distributed by these virus authors. And the timing of the mailings shows that the malicious code is being sent either automatically or semi-automatically.

So virus writers have not only joined forces, but they’ve automated the process of infecting computers and finding new victim machines. They understand that legislation is powerless to stop them, and are continuing to extend their reach. This latest case is another nail in the coffin of a safe, user-friendly Internet.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.