Ajay Kumar: Created a new article

2023-09-25T18:39:28Z

Created a new article

New page

{{short description|Computer worm}}
'''''Code Shikara''''' is a [[computer worm]], related to the [[Dorkbot (malware)|Dorkbot family]], that attacks through [[Social engineering attack|social engineering]].

== Timeline ==
In 2011, the Code was first identified by the Danish [[cyber security]] company CSIS. The [[Antivirus software|AV]]-company [[Sophos]] reported in November 2011 that this threat mainly spreads itself through malicious links through the social network [[Facebook]].<ref>{{cite web|url=https://www.csis.dk/|title=CSIS - Exceptional threat intelligence|publisher=}}</ref><ref name=autogenerated1>{{cite web|url=https://nakedsecurity.sophos.com/2011/11/29/facebook-worm-two-blonde-women/|title=Facebook worm poses as two blonde women|date=29 November 2011|publisher=}}</ref>

In 2013, [[Bitdefender Labs]] caught and blocked the worm, which is capable of [[Spyware|spying]] on users' [[Web navigation|browsing activities]], meanwhile stealing their personal online/offline information and/or credentials, commonly known as [[cybercrime]]. The [[Vector (malware)|infection]] was originally flagged by the [[online backup service]] [[MediaFire]], who detected that the worm was being distributed camouflaged as an [[image file]]. Despite the misleading extension, MediaFire successfully identified the malicious image as an [[.exe]]-file. The malicious Shikara Code poses as a [[.jpeg]] image, but is indeed an [[executable file]]. As an [[IRC bot]], the malware is simply integrated by the attackers from a [[control and command server]]. Besides stealing usernames and passwords, the [[bot herder]] may also order additional malware downloads.

MediaFire had then taken steps to address incorrect and misleading file extensions in an [[Patch (computing)|update]], which identified and displayed a short description by identifying specific file types. To help users for this specific threat, the [[file sharing]] service also blocked files with double extensions, such as .jpg.exe, .png.exe, or .bmp.exe. Just like usual malware, the [[Backdoor.IRCBot.Dorkbot]] can update itself once installed on the victim's computer or other related [[Peripheral|devices]].<ref>{{cite web|url=https://hotforsecurity.bitdefender.com/blog/dorkbot-malware-infects-facebook-users-spies-browser-activities-and-grabs-data-6165.html|title=Dorkbot Malware Infects Facebook Users; Spies Browser Activities...|date=14 May 2013|publisher=}}</ref>

The biggest risk is that someone's Facebook contacts may have had their account already compromised (due to sloppy password security, or granting access to a [[rogue application]]) and that the account user has been allured by clicking on a link seemingly posted by one of their friends.

Although the links pretend to point to an image, the truth is that a malicious [[screensaver]] is hidden behind an icon of two blonde women. After the code is launched, it attempts to download further malicious software hosted on a specific compromised Israeli domain. The malware is currently not present on the Israeli website. All that remains is a message, seemingly from the intruders, that says:

:::::::::::::::::::<big>Hacked By ExpLodeMaSTer & By Ufuq</big>

It is likely that they are using additional or other websites in continuing spreading their cyberattack(s). Some other popular baits tricking users to click on malicious links include [[Rihanna]] or [[Taylor Swift]] [[sex tape]]s.<ref name=autogenerated1 /><ref>{{cite web|url=https://nakedsecurity.sophos.com/2011/12/05/facebook-chat-worm-continues-spread/|title=Facebook chat worm continues to spread|date=5 December 2011|publisher=}}</ref>

== Statistics ==
* '''''Niger:''''' Due to Information from the [[Kaspersky Cybermap]], Shikara Spam Code has been ranking in April 2017 the Top number 1 in the country of [[Niger]] with 77.51%. Place #2 sits as Linguistic Analysis far behind, with 14.7%.<ref name="kaspersky.com">{{cite web|url=https://cybermap.kaspersky.com/stats/#country=208&type=kas&period=m|title=Kaspersky Cyberthreat real-time map|publisher=}}</ref>

* '''Code Shikara''' mainly circulates in following Countries (STATISTICS - April 22nd 2017):
: Afghanistan (81.27%)
: Romania (78.58%)
: Algeria (78.56%)
: India (78.46%)
: Niger (77.51%)
: Turkey (75.49%) <ref name="kaspersky.com"/>

== See also ==
*{{annotated link|Alert (TA15-337A)}}
*{{annotated link|Computer worm}}
*{{annotated link|Dorkbot (malware)}}
*{{annotated link|Malware}}

==References==
{{reflist}}

== External links ==
*[https://www.us-cert.gov/ncas/alerts/TA15-337A Alert (TA15-337A) @ United States Computer Emergency Readiness Team] (''[[US-CERT]]'')
*[https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32%2FDorkbot Technical information @ Microsoft]
*[https://blogs.technet.microsoft.com/mmpc/2015/12/02/microsoft-assists-law-enforcement-to-help-disrupt-dorkbot-botnets/ Microsoft assists law enforcement to help disrupt Dorkbot botnets @ technet.microsoft.com]

{{Malware}}
{{Software distribution}}

[[Category:2011 in computing]]
[[Category:Botnets]]
[[Category:Email worms]]
[[Category:Exploit-based worms]]
[[Category:File sharing]]
[[Category:Hacking in the 2010s]]
[[Category:Identity theft]]
[[Category:Instant messaging]]
[[Category:Internet Relay Chat]]
[[Category:Internet Relay Chat bots]]
[[Category:Password authentication]]
[[Category:Social engineering (computer security)]]
[[Category:Spamming]]
[[Category:Spyware]]
[[Category:Windows malware]]
[[Category:Cybercrime in India]]

Code Shikara - Revision history

Ajay Kumar: Created a new article