Research

IM malware tries a new approach

We’ve recently received several inquiries regarding a certain worm.
At first glance, this worm didn’t seem to have any new features. The combination of spreading via P2P and IM is not new at all.

When I had time to investigate further, I noticed something interesting.
Instead of relying on ‘real’ webservers, this malware simply turns the infected machine into a webserver.
The biggest advantage this approach has is the fact that the host is fairly unlikely to be shut down quickly.

As you can see from the description the worm connects to a specific server to determine the computer’s (outside) I.P. address.
Most likely this is done to circumvent the problem of internally used I.P. addresses on computers, such as the 10.x.x.x and the 192.168.x.x ranges.

This is an interesting new approach. But for it to be effective, machines within a LAN will have to have the necessary portforward in place, and I’m not sure that this is widespread. We’ll keep you posted on any developments.

IM malware tries a new approach

Your email address will not be published. Required fields are marked *

 

Reports

APT trends report Q3 2021

The APT trends reports are based on our threat intelligence research and provide a representative snapshot of what we have discussed in greater detail in our private APT reports. This is our latest installment, focusing on activities that we observed during Q3 2021.

Lyceum group reborn

According to older public researches, Lyceum conducted operations against organizations in the energy and telecommunications sectors across the Middle East. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.

Subscribe to our weekly e-mails

The hottest research right in your inbox