- Jan 24, 2011
- 9,379
It looks like Koobface has started to lose interest in Facebook. We first observed this dramatic change around February this year. All of a sudden, we saw bot herders are no longer instructing zombies to post fake messages to compromised Facebook accounts. Our first impression was that it's just a temporarily move but a continued silence for about two months is not something that can be ignored. Last time we saw Koobface trying to pollute Facebook was around Feb 13th, at that time one of the messages posted looked like this:
February 13 at 3:19pm
Youu’ve beren caght on our supefr smmall spy camerea!
htxp://12344cederberglineki.blogspot.com
where as usual, the posted link was redirecting users to a fake YouTube video urging them to install a fake codec (in reality a Koobface malware binary) in order to watch a so called stunning video.
What's Koobface doing at the moment? Is it dead? Well the answer is 'no'. Koobface C&Cs are very much alive. We observed around 153 live C&Cs during last 7 days. It's just that Koobface is no longer using Facebook to spread itself.
More details - link
February 13 at 3:19pm
Youu’ve beren caght on our supefr smmall spy camerea!
htxp://12344cederberglineki.blogspot.com
where as usual, the posted link was redirecting users to a fake YouTube video urging them to install a fake codec (in reality a Koobface malware binary) in order to watch a so called stunning video.
What's Koobface doing at the moment? Is it dead? Well the answer is 'no'. Koobface C&Cs are very much alive. We observed around 153 live C&Cs during last 7 days. It's just that Koobface is no longer using Facebook to spread itself.
More details - link
