Malware descriptions

Move on, move on…

There’s a new Trojan spreading in Russia. You might think that’s nothing new, and that the crowd control (aka the AV industry) would be saying ‘Move on. There’s nothing to see’.

But in this case it’s a bit different. We picked up this Trojan a while ago, but the latest variant of Trojan-SMS.J2ME.Konov is now spreading via social networking sites, specifically “Vkontakte” (the Russian version of Facebook).

So how does it work? Well, Vkontakte’s been spammed with messages saying “Hi! Guess what, today the first channel news showed Zuganov’s got a campaign running throughout Russia – he’s got a big budget to support the KPRF [editor’s note: Communist Party of the Russian Federation]. He’s making the following offer – download a JAVA program to your mobile and it’ll send a request to add 500 roubles to your account. Everybody gets it. 1 phone number can take part once. It worked for me! Try it. You can download the program to your computer and then send it to your phone. Download the program by by going to [link].

If the user launches this program on his/ her phone, then the Trojan which has been downloaded sends an SMS message to five premium numbers – and the user doesn’t know anything about it. Each SMS costs around $10, which is pretty high, even for an SMS to a premium number.

The Trojan isn’t sophisticated from a coding point of view. Yep, there’s nothing to see. But in terms of how it’s spreading, now that’s interesting. It’s mobile malware spreading via social networking sites – and this is just what we predicted would happen.

Needless to say, we’ve denylisted the site the Trojan spreads from, and we detect it as Trojan-SMS.J2ME.Konov.b. But it’s yet another warning to users to be on their guard – the next Russian elections aren’t for around four years, but this case shows that cyber criminals are using everything they’ve got in their arsenal.

Move on, move on…

Your email address will not be published. Required fields are marked *

 

Reports

APT trends report Q3 2021

The APT trends reports are based on our threat intelligence research and provide a representative snapshot of what we have discussed in greater detail in our private APT reports. This is our latest installment, focusing on activities that we observed during Q3 2021.

Lyceum group reborn

According to older public researches, Lyceum conducted operations against organizations in the energy and telecommunications sectors across the Middle East. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.

Subscribe to our weekly e-mails

The hottest research right in your inbox