Staying under the radar

The following article by the Register caught my attention: "NHS computers hit by voracious, data-stealing worm"

The interesting thing is that Qakbot is a known malware, well-documented by Symantec. Therefore, COTS Anti-Virus product should catch it, right?

As described on the Register, Qakbot spreads through Web pages that install malware by exploiting patched vulnerabilities in Microsoft’s Internet Explorer and Apple’s QuickTime software. It is able to self-propagate on local networks through file shares. It "moves slowly and with caution, trying not to bring attention to its presence" it is staying under the radar!

For some reason, the National Health Service (NHS) network was hit by a malware which has been known since May 2009… Could it be another sign that COTS cyber security products can be circumvented by advanced malware?

For me, this is just another confirmation that COTS security must be complemented by additional layers of custom-built cyber defense.

Jerome