Virus authors form unholy alliance

Bagle, Zafi and Netsky coders thought to be working together

Robert Jaques, vnunet.com 08 Mar 2005

The authors of the Bagle, Zafi and Netsky viruses have joined forces in an unholy alliance that aims to spread cyber-terror, security experts have claimed.

The warning comes from virus analysts at Kaspersky Lab investigating the recent Bagle outbreak and suggest that the authors of Bagle, Zafi and Netsky are "working hand in hand with each other".

Evidence of the collaboration came on 15 February after the Kaspersky team first detected the SpamTool.Win32.Small.b malicious code which harvests email addresses from infected machines. Email addresses of antivirus companies are excluded from the list it compiles.

"Further analysis of the situation reveals that the mass mail of this program was a preliminary stage in the attack carried out by Bagle on 1 March," Kaspersky stated.

"In researching the Bagle outbreak, virus analysts have concluded that the authors of Bagle, Zafi and Netsky and others are working closely together. They may not be personally known to each other, but they are all using information provided by the author of Bagle to mass mail their creations."

According to Kaspersky, approximately 50 modifications of a range of malicious programs were mass mailed in the space of just two days. The timing of these mailings "clearly shows that they are automated or semi-automated".

"These recent events confirm the trend towards the criminalisation of the internet. And likely as not, events will continue to evolve in such a way. Network attacks are now automated, take place in several stages, and are carefully timed and planned," Kaspersky warned.

"The authors of malicious code are joining forces, exchanging information and techniques, in order to increase the impact of attacks."

See also: