A new multilingual worm from Hungary hit networks over the weekend and is spreading steadily.
Zafi.B, also known as Erkez.b or Hazafi, spreads via peer-to-peer software and as a 12,800 byte .pif attachment within emails.
It has the potential to spread widely as it mails itself out in Hungarian, English, Italian, Spanish, Russian and Swedish.
"We got a lot of this at the weekend. 58 per cent of all our returns are this worm," said Graham Cluley, senior analyst at Sophos. "Some people are not suspicious of non-English viruses, so that could be helping it spread."
Once activated the worm copies itself into the registry file and starts harvesting email addresses and mailing itself forward using its own SMTP engine.
Zafi.B also terminates any application that has 'firewall' or 'virus' in its filename and several Windows tools, like Task Manager and Registry Editor.
Its predecessor, Zafi.A, surfaced in April but had little impact outside Hungary as it only sent itself to .hu addresses.
The motivation for the writer appears to be political in both cases. Zafi.B contains code urging the Hungarian government to accommodate the homeless and bring back the death penalty.
Brexit labour shortages will lead to higher adoption of robotics
Newbies will be thrown in with the big boys on Sanhok as Kar98 fodder
Data is the perfect intersection of logic and emotion
Support for RTX Technology and new version of GPU Boost algorithm coming in next-gen Nvidia GPUs