Malware descriptions

Move on, move on…

There’s a new Trojan spreading in Russia. You might think that’s nothing new, and that the crowd control (aka the AV industry) would be saying ‘Move on. There’s nothing to see’.

But in this case it’s a bit different. We picked up this Trojan a while ago, but the latest variant of Trojan-SMS.J2ME.Konov is now spreading via social networking sites, specifically “Vkontakte” (the Russian version of Facebook).

So how does it work? Well, Vkontakte’s been spammed with messages saying “Hi! Guess what, today the first channel news showed Zuganov’s got a campaign running throughout Russia – he’s got a big budget to support the KPRF [editor’s note: Communist Party of the Russian Federation]. He’s making the following offer – download a JAVA program to your mobile and it’ll send a request to add 500 roubles to your account. Everybody gets it. 1 phone number can take part once. It worked for me! Try it. You can download the program to your computer and then send it to your phone. Download the program by by going to [link].

If the user launches this program on his/ her phone, then the Trojan which has been downloaded sends an SMS message to five premium numbers – and the user doesn’t know anything about it. Each SMS costs around $10, which is pretty high, even for an SMS to a premium number.

The Trojan isn’t sophisticated from a coding point of view. Yep, there’s nothing to see. But in terms of how it’s spreading, now that’s interesting. It’s mobile malware spreading via social networking sites – and this is just what we predicted would happen.

Needless to say, we’ve denylisted the site the Trojan spreads from, and we detect it as Trojan-SMS.J2ME.Konov.b. But it’s yet another warning to users to be on their guard – the next Russian elections aren’t for around four years, but this case shows that cyber criminals are using everything they’ve got in their arsenal.

Move on, move on…

Your email address will not be published. Required fields are marked *



Meet the GoldenJackal APT group. Don’t expect any howls

GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. The main feature of this group is a specific toolset of .NET malware, JackalControl, JackalWorm, JackalSteal, JackalPerInfo and JackalScreenWatcher.

APT trends report Q1 2023

For more than five years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. These summaries are based on our threat intelligence research; and they provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.

Subscribe to our weekly e-mails

The hottest research right in your inbox