Autumn leaves

Today is the last day of the ISSE/Secure 2007 conference, which is taking place in the beautiful city of Warsaw. I gave the keynote speech at ISSE, along with Steve Lipner from Microsoft. My presentation was about the transition from viruses to malware and the rise of cybercrime, showing some of the latest tricks used by malware authors with a focus on the Zlob and Zhelatin worms.

Last week was busy as well. We attended the Virus Bulletin Conference in Vienna where Roel gave a talk on a particular variant of Banker, a family of trojans designed to steal your bank account details in a very crafty way.

While we were away, the malware activity was restricted to the usual stream of Mytob, Banload, Banker trojans and Pinch variants. The Zhelatin gang seems to have stopped their activity for a bit – they’re probably preparing a new wave of attacks.

And over here in Romania, the academic year is starting in a couple of days so we’re enjoying a few days of calm, before the ‘Storm’.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.