Malware reports

News from the Mobile Front

The first quarter of 2006 marks a turning point in mobile malware development. The era of quantitative development, with its numerous, but primitive Trojans for Symbian OS has ended. The quality of mobile malware has changed visibly.

Let’s consider a chronological list of mobile viruses that appeared in early 2006:

What does the list show us?

We see that writers of mobile malware have begun to use new programming languages: .NET (“.MSIL.”) and Java (“.J2ME.”).

Moreover, a new fashion seems to be emerging: a bias towards cross-platform viruses. For example, Worm.MSIL.Cxover, infects mobile devices that can be accessed via ActiveSync when it is executed on a PC. Yet it also infects the PC using the same mechanism when launched on a mobile device.

Then we have Trojan-Spy.SymbOS.Flexispy: a commercial Trojan that collects information about phone calls and SMS messages. Of course, it is only one example, but it is enough to show that the industry of mobile viruses has at last made headway into commerce on the one hand and into spying on the other.

And I think this is just a beginning.

News from the Mobile Front

Your email address will not be published. Required fields are marked *

 

Reports

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Lazarus targets defense industry with ThreatNeedle

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Subscribe to our weekly e-mails

The hottest research right in your inbox