Malware going local

Posted by   Virus Bulletin on   Feb 22, 2008

Report sees trend toward greater localisation of threats.

McAfee's latest Sage report focuses on increased localisation in malware, with spam, phishing and malcode all showing great improvements in their use of local languages and targeting of regional resources and computing methods.

The report carries stories from various regions around the globe, detailing the popularity of peer-to-peer filesharing in Japan and China, and the consequent explosion in malware using P2P as a vector for spreading. The growth of online gaming universes is also highlighted, with the potential to convert in-game resources into real-world cash again resulting in an upsurge in malware hijacking gaming accounts and stealing gaming resources - with activity particularly focused in China. The report also details the economic pressures behind the upsurge in malware creation, botnet operations and spamming in Russia, and the epidemic of trojans targeting online banking in Brazil. There is also an in-depth study of the increasing use of local languages in both malware and spam, enabling spammers and other cybercriminals to target more specific groups with more focused social engineering techniques.

'This is a trend we've been seeing for some time now,' said John Hawes, Technical Consultant at Virus Bulletin. 'The dodgy grammar and bizarre syntax of earlier spam campaigns and messages from malware have become a much less reliable means of spotting scams, and as English-language spam and malware has become more professional, translators have also been brought in to provide high-quality localised versions. Fortunately, many malware labs have a broad global presence, and analysts should be able to keep up with multilingual malware - delegates at last year's VB conference were treated to a great talk from Symantec's Masaki Suenaga, showing off some handy tools for extracting and identifying multilingual text from malcode as part of the analysis process, and I'm sure these kinds of tools will come in more and more handy as the globalisation of malware continues.'

The McAfee report is available (as a large PDF file) here. Security professionals keen to stay ahead of the curve on the latest trends in the malware world can register here for the next VB conference, being held 1-3 October in Ottawa, Canada.

Posted on 22 February 2008 by Virus Bulletin



Latest posts:

VB2019 paper: Fantastic Information and Where to Find it: A guidebook to open-source OT reconnaissance

A VB2019 paper by FireEye researcher Daniel Kapellmann Zafra explained how open source intelligence (OSINT) can be used to learn crucial details of the inner workings of many a system. Today we publish Daniel's paper and the recording of his…

VB2019 paper: Different ways to cook a crab: GandCrab Ransomware-as-a-Service (RaaS) analysed in depth

Though active for not much longer than a year, GandCrab had been one of the most successful ransomware operations. In a paper presented at VB2019 in London, McAfee researchers John Fokker and Alexandre Mundo looked at the malware code, its evolution…

VB2019 paper: Domestic Kitten: an Iranian surveillance program

At VB2019 in London, Check Point researchers Aseel Kayal and Lotem Finkelstein presented a paper detailing an Iranian operation they named 'Domestic Kitten' that used Android apps for targeted surveillance. Today we publish their paper and the video…

VB2019 video: Discretion in APT: recent APT attack on crypto exchange employees

At VB2019 in London, LINE's HeungSoo Kang explained how cryptocurrency exchanges had been attacked using Firefox zero-days. Today, we publish the video of his presentation.

VB2019 paper: DNS on fire

In a paper presented at VB2019, Cisco Talos researchers Warren Mercer and Paul Rascagneres looked at two recent attacks against DNS infrastructure: DNSpionage and Sea Turtle. Today we publish their paper and the recording of their presentation.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.