Threat Category: Windows malware | Page 19

The following statistics were compiled in February using data collected from computers running Kaspersky Lab products: 143,574,335 web-borne infections were prevented.

This section of the report is based on data obtained and processed using the Kaspersky Security Network (KSN).

The following statistics were compiled in November using data collected from computers running Kaspersky Lab products

The sky is the limit for cybercriminal’s creativity. The latest wave are malicious boot loaders, the kit has been pioneered by Brazilian Trojan bankers who aim to remove security software.

In the past we’ve seen Rogue AV websites using fake screenshots made with templates but without any real interaction with the user PC. Now it has been changed.

The following statistics were compiled in October using data collected from computers running Kaspersky Lab products: 161,003,697 network attacks were blocked.

Since June 2011 we have seen a substantial decrease in the number of fake antivirus programs.

Analysis of a R2D2 trojan version that supports 64 bit and comes with a long target process list

The following statistics were compiled in September using data collected from computers running Kaspersky Lab products

My colleague Jorge Mieres recently found a C&C server of a botnet based on a malicious program called Ice IX

After rumors about the supposed merger between SpyEye and ZeuS, and the public release of the source of the latter, it was logical that the range of possibilities opened up even more for new cybercriminals into the ecosystem of crimeware.

Scar is a basic peer-to-peer botnet that serves as a distribution channel for installing other bad stuff.

In 2010 we noted a decline in the number of players in the fake antivirus market, and as a result, fewer counterfeit programs used to distribute fake antivirus products

Attacks registering a remote user account called ‘Remo’ which is password-protected allow Brazilian cybercriminals to have total access and control over infected machines.

Modification of the hard drive areas responsible for the initial loading of the system has become increasing popular with cybercriminals.

Reports

Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.

Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT.

The Silver Fox group is targeting companies in Russia and India by impersonating tax authorities to distribute ValleyRAT and the new ABCDoor backdoor.

Kaspersky researchers analyze updated CoolClient backdoor and new tools and scripts used in HoneyMyte (aka Mustang Panda or Bronze President) APT campaigns, including three variants of a browser data stealer.

Windows malware

Monthly Malware Statistics: February 2012

Kaspersky Security Bulletin. Statistics 2011

Monthly Malware Statistics: November 2011

Malicious Boot loaders

Choose your preferred Fake AV

Monthly Malware Statistics: October 2011

Fake AV business alive and kicking

Federal Trojan’s got a “Big Brother”

Monthly Malware Statistics: September 2011

Ice IX: not cool at all

Ice IX, the first crimeware based on the leaked ZeuS sources

The Miner Botnet: Bitcoin Mining Goes Peer-To-Peer

IT Threat Evolution: Q2 2011

All your data belong to ‘Remo’

Cybercriminals switch from MBR to NTFS

Reports

Kimsuky targets organizations with PebbleDash-based tools

OceanLotus suspected of using PyPI to deliver ZiChatBot malware

Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India

HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns

Subscribe to our weekly e-mails