Malware going local

Posted by   Virus Bulletin on   Feb 22, 2008

Report sees trend toward greater localisation of threats.

McAfee's latest Sage report focuses on increased localisation in malware, with spam, phishing and malcode all showing great improvements in their use of local languages and targeting of regional resources and computing methods.

The report carries stories from various regions around the globe, detailing the popularity of peer-to-peer filesharing in Japan and China, and the consequent explosion in malware using P2P as a vector for spreading. The growth of online gaming universes is also highlighted, with the potential to convert in-game resources into real-world cash again resulting in an upsurge in malware hijacking gaming accounts and stealing gaming resources - with activity particularly focused in China. The report also details the economic pressures behind the upsurge in malware creation, botnet operations and spamming in Russia, and the epidemic of trojans targeting online banking in Brazil. There is also an in-depth study of the increasing use of local languages in both malware and spam, enabling spammers and other cybercriminals to target more specific groups with more focused social engineering techniques.

'This is a trend we've been seeing for some time now,' said John Hawes, Technical Consultant at Virus Bulletin. 'The dodgy grammar and bizarre syntax of earlier spam campaigns and messages from malware have become a much less reliable means of spotting scams, and as English-language spam and malware has become more professional, translators have also been brought in to provide high-quality localised versions. Fortunately, many malware labs have a broad global presence, and analysts should be able to keep up with multilingual malware - delegates at last year's VB conference were treated to a great talk from Symantec's Masaki Suenaga, showing off some handy tools for extracting and identifying multilingual text from malcode as part of the analysis process, and I'm sure these kinds of tools will come in more and more handy as the globalisation of malware continues.'

The McAfee report is available (as a large PDF file) here. Security professionals keen to stay ahead of the curve on the latest trends in the malware world can register here for the next VB conference, being held 1-3 October in Ottawa, Canada.

Posted on 22 February 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2019 paper: APT cases exploiting vulnerabilities in region-specific software

At VB2019, JPCERT/CC's Shusei Tomonaga and Tomoaki Tani presented a paper on attacks that exploit vulnerabilities in software used only in Japan, using malware that is unique to Japan. Today we publish both their paper and the recording of their…

New paper: Detection of vulnerabilities in web applications by validating parameter integrity and data flow graphs

In a follow-up to a paper presented at VB2019, Prismo Systems researchers Abhishek Singh and Ramesh Mani detail algorithms that can be used to detect SQL injection in stored procedures, persistent cross-site scripting (XSS), and server‑side request…

VB2020 programme announced

VB is pleased to reveal the details of an interesting and diverse programme for VB2020, the 30th Virus Bulletin International Conference.

VB2019 paper: Cyber espionage in the Middle East: unravelling OSX.WindTail

At VB2019 in London, Jamf's Patrick Wardle analysed the WindTail macOS malware used by the WindShift APT group, active in the Middle East. Today we publish both Patrick's paper and the recording of his presentation.

VB2019 paper: 2,000 reactions to a malware attack – accidental study

At VB2019 cybercrime journalist and researcher Adam Haertlé presented an analysis of almost 2000 unsolicited responses sent by victims of a malicious email campaign. Today we publish both his paper and the recording of his presentation.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.