The Anti-virus Times

Thursday, July 27, 2017

Seemingly everything is quite clear: a site has been compromised and is now hosting malware, or a man-in-the-middle attack has occurred, or a resentful employee has taken revenge on their colleagues. But in reality, it's not that simple. Let's figure out what’s going on here.

Malware descriptions often indicate that a program doesn't operate on machines residing in certain countries. And many people assume that happens because the malware writers involved are noble hackers. But that’s not true.

1. Malware is often used to help criminals convert illegal money into cash. How and where can they find a network of droppers (people who will withdraw their stolen money)?
2. All transactions involving banks overseas are usually monitored rigorously by the corresponding government agencies engaged in fighting corruption and money laundering.
3. However, an investigation involving organisations from other countries requires coordination with the law enforcement agencies of the respective states and thus takes much more time than catching criminals on home soil.
4. By reducing the number of countries in which a malicious program will operate, attackers also reduce the probability it will be detected. If the target list is narrowed down even further to include only specific categories of computers, the risk of detection will decrease even more, and the media is less likely to be interested in incidents involving that malware strain.

It is also interesting how the spreading technique used by a certain malware species affects its popularity with the media.

Four times as many infections and no panic attack in the media? Well, there’s a reason for that. WannaCry (Trojan.Encoder.11432) primarily targeted home PCs and machines belonging to large companies and didn't pay much attention to small businesses. Meanwhile, Trojan.Encoder.11526, which we discuss in this issue, focused on different companies, and the result is quite obvious.

As a result, many malicious programs are designed to work with banks located in one country—the country in which droppers will be withdrawing money from cash points. Naturally, in Russia, too, there exist Trojans intended to target, for example, Chinese users, but they are of no use to money collectors since they would only draw unnecessary attention to themselves.

Perhaps, great timing made this attack so successful. If an update is released for a popular application, it is then installed on huge numbers of computers, and the activity of another program may go unnoticed. Clever!

A lack of control over events in a local network is one major security problem. As a result, not only does the penetration remain undiscovered, the malicious modules facilitating the intrusion also go undetected.