Koobface on the rise

In June, we saw an explosive rise in the number of Koobface modifications – the number of variants we detected jumped from 324 at the end of May to nearly 1000 by the end of June. And this weekend brought another flood, bringing us up to 1049 at the time of writing.

As we’ve said before, Koobface spreads via major social networking sites like Facebook and MySpace. It’s now spreading via Twitter as well.

Normally the increase in the number of malicious programs slows a bit over the summer with lots of people (virus writers, cybercriminals etc.) taking a bit of time off. But in the case of Koobface, the opposite has happened. This is probably because cybercriminals have realized that spreading malware via social networking sites is very effective.

June 2009 is an important milestone in the history of social network malware; the activity we’ve seen this month far exceeds anything we’ve previous seen. With everyone who’s anyone now having a Facebook page, Twitter account or similar, the pool of potential victims is growing day by day – just take a look at the Alexa stats for Facebook. So naturally, cybercriminals are going to be targeting these sites more and more often.

Koobface on the rise

Your email address will not be published. Required fields are marked *



APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Subscribe to our weekly e-mails

The hottest research right in your inbox