Kaspersky Lab specialists have discovered a wide network for distribution of a range of dangerous software named Koler. This software was aimed at Android devices as well as users’ personal computers. Potential victims were lured by the promise of pornographic content, but risked to get their devices infected with blocker-software. At the screen of the blocked devices was shown an allegedly official message from the police and a demand to pay a fine from 100 to 300 dollars for browsing pornographic materials. Thanks to the type of websites which the victims tried to browse this message had a powerful psychological effect.

Despite the fact that the blocker-software was very basic and could only block the window, the specialists note that the perpetrators used different texts and symbols of law enforcement agencies for 30 different countries of Europe, North and Latin America and Australia. Further investigation lead to discovery of a developed and organized network which ensured the distribution of harmful software.

Users were lured by means if 48 pornographic websites. From there the requests were redirected to the centre of redistribution of traffic system and then victims found themselves on one of many servers which distributed this harmful software. Due to the fact that the viruses were aimed at Android devices as well as personal computers so for each target there was a separate sub-network which distributed similar blockers. According to the statistics received by Kaspersky Lab specialists just on one of the sub-networks with mobile harmful software were redirected more than 170 thousands users. At the moment the growth has decreased – on the 23th of July perpetrators gradually began to close the network and send through the main server deinstallation commands to the infected devices.

«In the wake of the discovered blocker-software we managed to discover not only a major infrastructure of its distribution but also a range of new harmful software for Android, which is not used by perpetrators just yet. Perhaps they are planning to widen their campaign later on. The ease with which perpetrators used the automatised systems and managed to unleash an entire network for the distribution of software may become a bad example which in the future harm many more users in other countries. We have to note that the method of distribution used by perpetrators is quite tricky, but the software itself is rather basic and can be blocked by an anti-virus software of the Internet Security spectum» – noted Vincente Dias, leading expert of Kaspersky Lab.

Source: Kaspersky Lab