New variant of Conficker strikes

New Conficker variant talks to servers associated with the Waledac botnet, and downloads an ‘unknown’ payload.

Security researchers have discovered a new variant of Conficker, which has downloaded a payload from servers connected to the Waledac botnet.

A week after the April Fool's Conficker scare, a dropper' came through which updated Conficker and added new functionality through its P2P connectivity.

The new Conficker variant was also talking to servers and websites that were already known for their associations with the Waledac family of malware.

Trend Micro said in an interview with eWeek it had already downloaded a further component that it was currently analysing, but had some "rootkit capabilities".

Trend Micro security expert Rik Ferguson said it could be the payload which could finally monetise the botnet: "These components have so far been missing, but could this finally be the other boot dropping' that we have all been been waiting for?"

Waledac is a spambot that steals sensitive information and turns computers into spam zombies.

It was suspected to be the latest threat from the people behind Storm, which could mean that the same cybercriminals were behind all three threats.

Ferguson said to IT PRO: "It tallies with some of the assumptions people have made about Conficker that the first variant was actively trying to avoid Ukraine because Waledac was Eastern European."

The worm also re-enabled propagation functionality which had previously been disabled on previous versions.

By connecting to one of myspace.com, msn.com, ebay.com and cnn.com, the worm helped establish whether a computer was internet connected or whether it could only infect a local network.

Users were warned not to be alarmed, and to continue to exercise caution and implement security best practices such as keeping patches current and antivirus definitions up to date.

More on the Conficker threat is here, while the worm threat of 2009 has also been looked at.

Featured Resources

How to choose an AI vendor

Five key things to look for in an AI vendor

Download now

The UK 2020 Databerg report

Cloud adoption trends in the UK and recommendations for cloud migration

Download now

2021 state of email security report: Ransomware on the rise

Securing the enterprise in the COVID world

Download now

The impact of AWS in the UK

How AWS is powering Britain's fastest-growing companies

Download now

Recommended

Trend Micro home network security flaws could let hackers take over PCs
Security

Trend Micro home network security flaws could let hackers take over PCs

26 May 2021
Ransomware criminals look to other hackers to provide them with network access
ransomware

Ransomware criminals look to other hackers to provide them with network access

17 Jun 2021
CVS Health data breach leaves a billion records exposed
data protection

CVS Health data breach leaves a billion records exposed

16 Jun 2021
Four in five ransomware victims suffer repeat attacks
ransomware

Four in five ransomware victims suffer repeat attacks

16 Jun 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

16 Jun 2021
Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021
What is HTTP error 400 and how do you fix it?
Network & Internet

What is HTTP error 400 and how do you fix it?

16 Jun 2021