Threat Category: Windows malware | Page 28

The middle of the month means it’s time for our miscellany, so let’s take a look at what the final month of summer brought us.

August once again turned out to be “dead season” for virus epidemics in 2007

It seemed as though we had almost completely got rid of the Rays and Brontok worms

As we gradually start the transition to autumn, let’s take a moment to look at the miscellaneous malware we saw at the height of summer 2007.

The activity of the botnet that was created in May via the Agent.bqs Trojan was only reaching its “design capacity” in June; by July it was in full swing

After a short break, Trojan Dialers are again at the top of the rankings based on the results of our July online scanner activity

Virus Descriptions 101

The middle of the month means it’s time for our miscellany, so let’s take a look at what the first month of summer brought us

Blackmailer – the return of Gpcode

We’re seeing a lot of reports about a new version of Backdoor.Win32.IRCBot.acd. This backdoor is a fairly limited IRCBot with spy capabilities combined with MSN-Worm functionality.

June’s top ten features six new malicious programs, half of which are new versions of Trojan downloaders.

Probably the most noteworthy event this month was the disappearance of May’s rabble-rouser, Sober.aa.

First and foremost this includes various means of modifying and packing code, in order to conceal the presence of malicious code in the system and to disrupt the functionality of antivirus solutions.

New Warezov downloader spammed along with banking PDF’s.

Virus writers didn’t take any time off over the public holidays, and the results of their labour have made their way into our May miscellany.

Reports

An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services.

Cloud Atlas attacks the public sector and diplomatic structures of Russia and Belarus, using ReverseSocks, SSH, and Tor for persistence in infected systems and its new tool, PowerCloud.

Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.

Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT.

Windows malware

Malware Miscellany, August 2007

Virus Top Twenty for August 2007

Online Scanner Top Twenty for August 2007

Malware Miscellany, July 2007

Virus Top Twenty for July 2007

Online Scanner Top Twenty for July 2007

Virus Descriptions 101

Malware Miscellany, June 2007

Blackmailer – the return of Gpcode

You can teach an old worm new tricks

Online Scanner Top Twenty for June 2007

Virus Top Twenty for June 2007

The evolution of self-defense technologies in malware

A green grin

Malware Miscellany, May 2007

Reports

ToddyCat: your hidden email assistant. Part 2

Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload

Kimsuky targets organizations with PebbleDash-based tools

OceanLotus suspected of using PyPI to deliver ZiChatBot malware

Subscribe to our weekly e-mails