ATM malware gang firebombs Russian anti-virus firm

Russian antivirus software developer Dr. Web fell victim to a physical attack by malware creators. A group calling itself the "Syndicate" threatened the anti-virus lab to retract reverse engineering analysis of their ATM skimming malware, and to remove all references to ATM skimmer viruses from the Dr. Web software.

Dr. Web refused to comply and had its lab in Saint Petersburg twice firebombed with only minor damage inflicted:

The antivirus company says it will not capitulate to VXer threats.

"Doctor Web considers its duty to provide users with the ultimate protection against the encroachments of cybercriminals," the company says.

"Consequently, efforts aimed at identifying and studying ATM threats are in progress as is work to improve Dr. Web ATM Shield."

Dr Web boss Boris Sharov told KrebsonSecurity the Syndicate was likely a customer of the malware rather than the authors.

He says three physical intrusions were made into the office but did not elaborate.

Boris reckons a job was placed on criminal underground forums requesting the bombing of the offices. He says the attacks seemed unprofessional and resulted in more damage from the firetrucks than flame.