Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

What’s Next in Malware After Kuluoz?

Summary: Unit 42 reports that Kuluoz, the Asprox-derived malware family that at its 2014 peak accounted for 80% of all malware sessions observed in WildFire, all but disappeared at the end of December 2014, with its command and control infrastructure largely shutting down in January. The team says it has seen no indication that the operators were arrested or forced to stop, and that Upatre, a downloader that typically installs the Dyre banking Trojan or CryptoWall ransomware, is now the top family.

Key Takeaway: A botnet responsible for 80% of observed malware sessions did not get taken down by anyone - it went quiet on its own, and the operators are presumed to be regrouping to redeploy with new evasions. The family that replaced it is a downloader built to drop banking Trojans and ransomware, so the drop in volume does not mean a drop in what lands on an endpoint.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related