July 1, 2009

Doctor Web presents a virus activity review for June 2009. The last month proved that e-mail remained one of the best means for quick distribution of malware all over the Internet. Doctor Web virus monitoring service also registered a surging number of phishing attacks targeting customers of online banking and electronic payment systems. Cyber-criminals tended to become more interested in multi-platform malware.

Viruses via e-mail

Mail viruses came into the spotlight in the first days of June. The last month saw the biggest number of messages with attached malware or message providing links to malware downloads registered in this year. Cyber-criminals employed various techniques to attract users’ attention to malicious e-mails and to trick them into opening attached files.

Most e-mails from cyber-criminals were plain-text. However, some of them featured design of e-mails from respected companies like Microsoft.

Malicious files were spread as attachments or a user received a link. Clicking on it started downloading of a virus but there were few virus-makers that used bogus web-sites to spread malware in June.

Messages were devoted to different topics. Many of them were greeting cards notifications. By now e-cards remain the most popular disguise. Cases of Trojans offered to victims as updates of e-mail clients (Microsoft Outlook, Ritlabs The Bat!) or as video codecs were more rare. Some users received messages concerning paid orders from an e-store. A user was informed about changes of parameters of his account (a message didn’t specify a payment system or any other online services web-site though).

In June e-mail was used to spread a wide range of malicious programs. Trojan.PWS.Panda.122 hidden with various packers became the leader among mailed malware that also included Trojan.Siggen.2447, Trojan.DownLoad.29459, Trojan.DownLoad.38602, Trojan.Fakealert.4471 and others.

At the end of June virus analysts also registered mailing of messages that contained links to web-sites advertising healthcare products. A wide variety of malicious programs and topic of messages featuring similar design show that several groups of cyber criminals are involved in distribution of malware over e-mail.

Multi-platform malware

In recent months virus makers showed growing interest in designing cross-platform malware that enabled them to target multiple computer platforms. Earlier there were quite few cross-platform implementations of malware (virus makers made several attempts to create viruses that would run under Windows as well as under Linux). However, nowadays the number of such malicious programs is growing.

The April virus activity review from Doctor Web described the Trojan.BrowseBan program that could be installed as a plugin for both Opera and Mozilla Firefox.

In June cyber-criminals shifted their aim towards users of Twitter. Given that the microblogging service has several millions of users worldwide and blogs are interconnected, a message with a link to a malicious program in one microblog followed by thousands of bloggers make all those bloggers potential targets of a virus attack.

It should also be noted that users of Twitter can be found among PC users as well as among those who prefer Mac which virus makers also took into account. The attack that was carried out June targeted PCs as well as Macs and the bogus web-site to which a victim was redirected detected the operating system of a target machine automatically and provided different files for downloading for different platforms.

Since Twitter post length is limited to 140 characters, malefactors often resorted to services that enabled them to use short aliases instead of long URL ((http://tinyurl.com, http://bit.ly) to direct users to malicious sites. Besides, a shortened link makes it hard to tell if it points to something nasty and therefore increases efficiency of an attack. Even though administration of some of the services attempt to monitor how the service is used, but such services play into hands of virus makers more often than not.

Another massive spreading of links to a fraudulent web-site over Twitter took placeat the end of June. This time Win32.Virut.56 was offered to users as a codec required to view a video clip.

Social networking web-sites

Popularity of social networking web-sites grows steadily among users as well as amid cyber-criminals striving to put their malicious plans into action. Trojan.Hosts and Trojan.Facebook became the most popular choices for cyber-criminals spreading malware over such web-sites.

Once installed Trojan.Hosts modifies the hosts file to redirect a user to a bogus web-site where a victim is offered a paid SMS registration on a social networking web-site.

Trojan.Facebook uses contacts information found in the compromised system to send a link to a supposed video codec to other users of a social networking resource. Of course, the codec is nothing more than the malicious program itself. When installed, it follows the same procedure.

Methods employed by cyber-criminals willing to spread malware over social networking web-sites or other similar means of communication (e.g instant messaging services, e-mail, etc.) do not change with the time. As a rule it is a download link or an attachment.

Users who have already been tricked into downloading malware by such messages can instantly tell if a message has been sent by a cyber criminal. That’s why targets of virus-makers are only new users but there are a lot of new-joiners every day.

Even though social networking web-sites are becoming more and more popular and their users grow in numbers, threats related to such web-resources are really view compared with the total number of malicious programs currently in the wild. The reason behind users knowing about Trojans links in messages but remaining unaware of viruses that travel between computers over removable data-storage devices is that social networking web-sites often become a topical issue for the media.

Spam

Spammers never hesitate to exploit breaking news in their mailings. In a few hours after death of Michael Jackson became known to the public it became one of the main subjects of spam e-mails replacing supposed news about events related to the latest Iran presidential election.

A number of phishing attacks also surged up .in June. The total amount of phishing e-mails increased as well as the target group that included customers of Bank of America, JPMorgan Chase Bank, Community State Bank, and St. George Bank as well as people that use PayPal, eBay and Amazon customers.

Malicious files detected in mail traffic in June

Malicious files detected on user machines in June