The most anticipated development breakthrough for IM-based malware is to close the loop in the propagation mechanism and automatically begin executing the malware on the target machine. The net effect of this will be significantly faster execution of the malware.
The second major breakthrough we expect to see is a change in the malware binary distribution method. Currently it requires that the malware be downloaded from a central distribution site, which means that it is easy to shut off this point. We expect authors to begin to propagate the malware from one infected machine to another, much like a traditional worm, using either the built-in file transfer capabilities of the worm or a mechanism such as TFTP (used by worms like Blaster) or HTTP fetches from the attacking machine. This will make eradication of the worm significantly harder.
Finally, we expect the number of messages sent to a user to entice them to accept the malware to grow, which would make message analysis more difficult.
Attackers have shown a widespread adoption of the IM-based worm as a major threat vector in recent months, and we expect this trend to continue. Because of the network structure, such worms can devastate enterprise networks. Instant messaging is here to stay, so it is inevitable that we will continue to face threats that use those networks to propagate.
