Hacktivism Meets Malware

I came across an article this morning on the SC Magazine site talking about a new virus called "MonaRonaDona" which takes a bit of a different twist when put next to most strains of malware released over the past couple of years. 

As we know malware made the move from a vehicle used to achieve fame or notoriety to a method used to make large amounts of money a few years ago.  Similar to how MBR rootkits are a bit of a throwback to a time when attacking the MBR was a popular method of virus infection, the MonaRonaDona worm is a throwback to the time when worms were written mostly for recognition.  Granted, there is a financial component to MonaRonaDona as well, it is not likely to be very successful.

MonaRonaDona appears to be spreading via malicious advertisements being posted on web sites.  The user will not know they are infected until they reboot their machine when they will receive a popup that states: "Hi, My name is MonaRonaDona. I am a Virus and I am here to Wreck Your PC. If you observe strange behavior with your PC, like program windows disappearing etc, it's me who is doing all this. I was created as a protest against the Human Rights Violation being observed throughout the world & the very purpose of my existence is to remind & stress the world to respect humanity."  This malware will also prevent the user from opening common programs on their PC such as Microsoft Office and Adobe applications.

Very noble, but I fail to see how preventing me from opening Word does anything to remedy crimes against humanity in places like Darfur.

Part of the intention of the worm author as well is to socially engineer the user of the infected PC to perform a search in the Google search engine for the name of the worm.  Among other fake sites engineered by the malware authors is a site to purchase a product named Unigray.  For $40 Unigray alleges that it can clean your PC of MonaRonaDona.  Of course, all it really cleans is your wallet out of $40 :)

Personally, this worm seems like a lot of work for what will likely be very little reward.  It is different though, especially with the hacktivism angle, from most other malware which makes it interesting. 

We've discussed before that we expect to see more political based spam as the presidential election year wears on, especially closer to Democratic and Republican convention times.  Expect to see more political based hacktivism type malware lures as the year progresses and as the race for the White House intensifies.  As we saw with the Ron Paul spam last November, the stage has been set to use spam as a method for propaganda distribution pertaining to the upcoming election!