Malware going local

Posted by   Virus Bulletin on   Feb 22, 2008

Report sees trend toward greater localisation of threats.

McAfee's latest Sage report focuses on increased localisation in malware, with spam, phishing and malcode all showing great improvements in their use of local languages and targeting of regional resources and computing methods.

The report carries stories from various regions around the globe, detailing the popularity of peer-to-peer filesharing in Japan and China, and the consequent explosion in malware using P2P as a vector for spreading. The growth of online gaming universes is also highlighted, with the potential to convert in-game resources into real-world cash again resulting in an upsurge in malware hijacking gaming accounts and stealing gaming resources - with activity particularly focused in China. The report also details the economic pressures behind the upsurge in malware creation, botnet operations and spamming in Russia, and the epidemic of trojans targeting online banking in Brazil. There is also an in-depth study of the increasing use of local languages in both malware and spam, enabling spammers and other cybercriminals to target more specific groups with more focused social engineering techniques.

'This is a trend we've been seeing for some time now,' said John Hawes, Technical Consultant at Virus Bulletin. 'The dodgy grammar and bizarre syntax of earlier spam campaigns and messages from malware have become a much less reliable means of spotting scams, and as English-language spam and malware has become more professional, translators have also been brought in to provide high-quality localised versions. Fortunately, many malware labs have a broad global presence, and analysts should be able to keep up with multilingual malware - delegates at last year's VB conference were treated to a great talk from Symantec's Masaki Suenaga, showing off some handy tools for extracting and identifying multilingual text from malcode as part of the analysis process, and I'm sure these kinds of tools will come in more and more handy as the globalisation of malware continues.'

The McAfee report is available (as a large PDF file) here. Security professionals keen to stay ahead of the curve on the latest trends in the malware world can register here for the next VB conference, being held 1-3 October in Ottawa, Canada.

Posted on 22 February 2008 by Virus Bulletin



Latest posts:

In memoriam: Prof. Ross Anderson

We were very sorry to learn of the passing of Professor Ross Anderson a few days ago.

In memoriam: Dr Alan Solomon

We were very sorry to learn of the passing of industry pioneer Dr Alan Solomon earlier this week.

New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

In a new paper, researchers Aditya K Sood and Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited in order to gather threat intelligence, and present a model of mobile AppInjects.

New paper: Collector-stealer: a Russian origin credential and information extractor

In a new paper, F5 researchers Aditya K Sood and Rohit Chaturvedi present a 360 analysis of Collector-stealer, a Russian-origin credential and information extractor.

VB2021 localhost videos available on YouTube

VB has made all VB2021 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.