Move on, move on…

There’s a new Trojan spreading in Russia. You might think that’s nothing new, and that the crowd control (aka the AV industry) would be saying ‘Move on. There’s nothing to see’.

But in this case it’s a bit different. We picked up this Trojan a while ago, but the latest variant of Trojan-SMS.J2ME.Konov is now spreading via social networking sites, specifically “Vkontakte” (the Russian version of Facebook).

So how does it work? Well, Vkontakte’s been spammed with messages saying “Hi! Guess what, today the first channel news showed Zuganov’s got a campaign running throughout Russia – he’s got a big budget to support the KPRF [editor’s note: Communist Party of the Russian Federation]. He’s making the following offer – download a JAVA program to your mobile and it’ll send a request to add 500 roubles to your account. Everybody gets it. 1 phone number can take part once. It worked for me! Try it. You can download the program to your computer and then send it to your phone. Download the program by by going to [link].

If the user launches this program on his/ her phone, then the Trojan which has been downloaded sends an SMS message to five premium numbers – and the user doesn’t know anything about it. Each SMS costs around $10, which is pretty high, even for an SMS to a premium number.

The Trojan isn’t sophisticated from a coding point of view. Yep, there’s nothing to see. But in terms of how it’s spreading, now that’s interesting. It’s mobile malware spreading via social networking sites – and this is just what we predicted would happen.

Needless to say, we’ve denylisted the site the Trojan spreads from, and we detect it as Trojan-SMS.J2ME.Konov.b. But it’s yet another warning to users to be on their guard – the next Russian elections aren’t for around four years, but this case shows that cyber criminals are using everything they’ve got in their arsenal.