Echoes from the past

It seems from information on the Danish web site of Medion that some of the laptops they shipped recently were infected with the boot sector virus Angelina. This virus, which infects the boot sector of floppy disks and the MBR (Master Boot Record) of hard disks, dates from the mid-1990s.

Once commonplace, such threats are now rare. And on the face of it, you might not expect viruses as old as this to be still around. But incidents like this remind us that they haven’t completely disappeared.

For those of you who haven’t had to grapple with such viruses, they infect when the machine is booted from an infected floppy disk. Of course, this typically happens by accident, when the user forgets that there’s a floppy disk in the drive. They infect at boot-up, before the operating system loads, so they will infect any PC configured to boot from the floppy drive. However, they only spread under DOS and (under specific conditions) Windows 9x. This is why they’re not very common.

So, if such threats are rare, do we detect them? Absolutely, you never know when such ‘legacy’ threats might put in an appearance.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.