New variant of Conficker strikes
New Conficker variant talks to servers associated with the Waledac botnet, and downloads an ‘unknown’ payload.

Security researchers have discovered a new variant of Conficker, which has downloaded a payload from servers connected to the Waledac botnet.
A week after the April Fool's Conficker scare, a dropper' came through which updated Conficker and added new functionality through its P2P connectivity.
The new Conficker variant was also talking to servers and websites that were already known for their associations with the Waledac family of malware.
Trend Micro said in an interview with eWeek it had already downloaded a further component that it was currently analysing, but had some "rootkit capabilities".
Trend Micro security expert Rik Ferguson said it could be the payload which could finally monetise the botnet: "These components have so far been missing, but could this finally be the other boot dropping' that we have all been been waiting for?"
Waledac is a spambot that steals sensitive information and turns computers into spam zombies.
It was suspected to be the latest threat from the people behind Storm, which could mean that the same cybercriminals were behind all three threats.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Ferguson said to IT PRO: "It tallies with some of the assumptions people have made about Conficker that the first variant was actively trying to avoid Ukraine because Waledac was Eastern European."
The worm also re-enabled propagation functionality which had previously been disabled on previous versions.
By connecting to one of myspace.com, msn.com, ebay.com and cnn.com, the worm helped establish whether a computer was internet connected or whether it could only infect a local network.
Users were warned not to be alarmed, and to continue to exercise caution and implement security best practices such as keeping patches current and antivirus definitions up to date.
More on the Conficker threat is here, while the worm threat of 2009 has also been looked at.
-
Cleo attack victim list grows as Hertz confirms customer data stolen
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
Lateral moves in tech: Why leaders should support employee mobility
In-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
By Keri Allan
-
Exploitation of Docker remote API servers has reached a “critical level”
News Hackers are targeting Docker’s remote access API as it allows them to pivot from a single container to the host and deploy malware with ease
By Solomon Klappholz
-
Cyber criminal underground “thriving” as weekly attacks surge by 75% in Q3 2024
Cyber attacks reached another all-time high this quarter as digital crime continues to be a highly profitable industry for threat actors
By Solomon Klappholz
-
Alarm raised over patched Phemedrone Stealer malware that's being used to target Windows PCs - here's what you need to know
News Phemedrone Stealer is being used to exploit a vulnerability in Windows Defender SmartScreen despite the issue being patched in November 2023
By Solomon Klappholz
-
SOC modernization and the role of XDR
Whitepaper Automate security processes to deliver efficiencies across IT
By ITPro
-
Uncovering the ransomware threat from global supply chains
Whitepaper Effectively mitigate ransomware risk
By ITPro
-
The near and far future of ransomware business models
Whitepaper Discover how criminals use ransomware as a cyberweapon
By ITPro
-
Trend Micro security predictions for 2023
Whitepaper Prioritise cyber security strategies on capabilities rather than costs
By ITPro
-
'Potentially unsecured' SMBs are propping up an IT supply chain riddled with ransomware
News More than half of IT supply chains have been impacted by ransomware attacks in recent years and organisations are failing to implement the necessary steps to prevent future damage
By Connor Jones