Move on, move on…

There’s a new Trojan spreading in Russia. You might think that’s nothing new, and that the crowd control (aka the AV industry) would be saying ‘Move on. There’s nothing to see’.

But in this case it’s a bit different. We picked up this Trojan a while ago, but the latest variant of Trojan-SMS.J2ME.Konov is now spreading via social networking sites, specifically “Vkontakte” (the Russian version of Facebook).

So how does it work? Well, Vkontakte’s been spammed with messages saying “Hi! Guess what, today the first channel news showed Zuganov’s got a campaign running throughout Russia – he’s got a big budget to support the KPRF [editor’s note: Communist Party of the Russian Federation]. He’s making the following offer – download a JAVA program to your mobile and it’ll send a request to add 500 roubles to your account. Everybody gets it. 1 phone number can take part once. It worked for me! Try it. You can download the program to your computer and then send it to your phone. Download the program by by going to [link].

If the user launches this program on his/ her phone, then the Trojan which has been downloaded sends an SMS message to five premium numbers – and the user doesn’t know anything about it. Each SMS costs around $10, which is pretty high, even for an SMS to a premium number.

The Trojan isn’t sophisticated from a coding point of view. Yep, there’s nothing to see. But in terms of how it’s spreading, now that’s interesting. It’s mobile malware spreading via social networking sites – and this is just what we predicted would happen.

Needless to say, we’ve denylisted the site the Trojan spreads from, and we detect it as Trojan-SMS.J2ME.Konov.b. But it’s yet another warning to users to be on their guard – the next Russian elections aren’t for around four years, but this case shows that cyber criminals are using everything they’ve got in their arsenal.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.