Criminals get hands on Russian malware

Sentinel Labs, the US security vendor, has located what is believed to be one of very first instances of cyber criminals getting their hands on government malware.

Udi Shamir, the head of research for Sentinel, filed a report in which he said that the malware known as Gyges has been recently tacked onto web-based banking Trojans, as well as ransomware, making them very hard to identify.

The malware gets its name from Greek mythology, namely ‘the ring of Gyges’.

Sentinel warned that as Gyges features complex ‘government grade’ techniques to aid anti-detection and anti-tampering, it can remain undetected for extended periods.

The firm was first aware of the malware back in March this year and became fascinated by the complex masking techniques used, leading its specialists to discover Gyges’ origins.

Shamir said:

“The malicious code used for all of these evasion techniques is significantly more sophisticated than the core executable. That led us to believe that it was previously used as a ‘bus’ or ‘carrier’ for much more sophisticated attacks such as government data exfiltration.

“We eventually recovered government traces inside the carrier code.”

Gyges may be among the most complex and difficult malware to detect, but in a small business, any basic malware can cause problems. A failure in recognising threats can cause businesses to underestimate the level of protection needed. Posting information security vacancies would be a good start in beginning to re-prioritise a not only important, but also topical, aspect of utilising information systems.