Trend Micro Reveals Working of Koobface Worm

Internet security company, Trend Micro, has recently released a report that exposes the true objective behind the rampant malware laden botnet. The research shows how the makers of Koobface monetize the worm through scareware, forged antivirus, click fraud, details stealing malware and online dating services.

The report states that while some botnets were chiefly made to send spam and to install other malware, the Koobface group has been using new methods to exploit their creation

David Perry, Global Director of Education, Trend Micro, states that unlike earlier when people always took malware as one piece of code (like Lovebug or Melissa), today Koobface has become a recurrent criminal enterprise using numerous pieces of code. He also said - it makes tougher to explain to the public that Koobface is not one file, as per the reports by DARKREADING on December 21, 2009.

The Koobface group uses several channels for earning revenue with its malware, which when it attacks a system turns the machine into one of its bots. Perry claims that Koobface has proved a successful attack on social networking. And its criminal model represents the kind of "evil corporation" that operates thriving malware operations.

With respect to FakeAV (which is probably the most "in" thing among cybercrooks today), the researchers have claimed that Koobface is affiliated with five different FakeAV gangs, each of which provides a unique kind of FakeAV. This discloses the challenge that FakeAV is a major threat to the security firm, which does not bother the complexity of the malware but on the business models their makers used.

Perry asserts that he was not shocked by the internal workings of the Koobface group. They got to see what they were expecting. The reason for this research is that they are posed with one query every time 'What is this doing?' The research shows that Koobface is not restricted to one thing only. They have been using social networking to leave malware and Trojan installers on several systems. After that, they use it to make huge botnet, and take portion of that botnet and sell or lease it to other attackers.

Related article: Trend Micro Detects Spam Mail Declaring World War III

» SPAMfighter News - 1/1/2010