ZeuS malware dominates October malware landscape

This is due, says Kaspersky, mainly to the ease with which the trojans in the ZeuS family can be configured to steal online data.

According to the report, a number of additional viruses have been appearing which are used to help grow the ZeuS botnet.

Virus.Win32.Murofet, for example, which was detected in early October, generates domain names that link to downloadable and executable ZeuS files, notes the study.

Kaspersky reports that the virus obtains the year, month, day and minute from the system, generates two double words, adds one of several popular domain zones, adds `/forum; to the end of the string and uses the data string as a link.

Vyacheslav Zakorzhevsky, a senior virus analyst with Kaspersky Lab and author of the monthly report, said that the malware demonstrates just how inventive and eager the ZeuS developers are to spread their creation around the world.

Another clear trend during October was the continuing growth in the popularity of fake archiving programmes. These programmes typically disguise themselves as tools to remove license protection from legal software.

Zakorshevsky's report notes that, after a user launches a fake archiving programme, they are asked to send an SMS to a premium number so they can access the contents of an archive.

In most cases, after a message is sent, the user receives instructions on how to use a torrent tracker and/or a link to it.

"There are a variety of hoax scenarios, but the result is always the same", he said, adding that the victim ends up spending money and does not get the file they wanted.

"This type of fraud is relatively new and only came to light a few months ago. It has attracted a lot of interest from cybercriminals ever since", he said.

More than a million attempted infections of this type have been detected each month by Kaspersky Lab since July 2010", he added.

What’s hot on Infosecurity Magazine?