This chart represents email-borne virus and malware activity blocked by AppRiver filters during the month of August. In 2009, we saw a large spike of email-borne malware during the months of September, October and November. It looks like they are off to an early start in 2010, as we have already quarantined more than 140 million viruses during the past month alone. This is the highest level we have seen since 2009.
Early yesterday morning we began seeing a large malware campaign using fake headlines of celebrity deaths to peak interest. The message blast started at about 4am and within the first few hours were coming in at rates over 100,000 messages per hour. The messages claimed to be breaking news that a certain celebrity had died in a car crash.
Here is a look at one of the messages:
File name: CNN Hot News.zip (contains .exe by the same name)
Subject: Utilizes different celebrity names that do not always match the one in the message body
Here is a look at the traffic pattern for this campaign:
In all we have blocked 658,337 of these messages since we started seeing them on 8/25. They seem to have slowed to only a trickle at this point. Which is typical for a big virus push, typically they will blast out one campaign for 12-24 hours and after that the attack vector becomes stale and they will move on to the next one. Since we know that cybercriminals are always eager to take advantage of big news stories by sending out fake news alerts that often contain malware, it is not surprising to see them creating their own headlines.
The messages all contain CNN Hot News.zip (106 KB) (which contains the .exe file). The file attached is malicious and is a recent variant of a “downloader” that we have been seeing quite a bit lately. A downloader will simply open a backdoor on the target machine that can be used in the future to install one or multiple different types of malware.
Early yesterday morning we began seeing a large malware campaign using fake headlines of celebrity deaths to peak interest. The message blast started at about 4am and within the first few hours were coming in at rates over 100,000 messages per hour. The messages claimed to be breaking news that a certain celebrity had died in a car crash.
Here is a look at one of the messages:
File name: CNN Hot News.zip (contains .exe by the same name)
Subject: Utilizes different celebrity names that do not always match the one in the message body
Here is a look at the traffic pattern for this campaign:
In all we have blocked 658,337 of these messages since we started seeing them on 8/25. They seem to have slowed to only a trickle at this point. Which is typical for a big virus push, typically they will blast out one campaign for 12-24 hours and after that the attack vector becomes stale and they will move on to the next one. Since we know that cybercriminals are always eager to take advantage of big news stories by sending out fake news alerts that often contain malware, it is not surprising to see them creating their own headlines.
The messages all contain CNN Hot News.zip (106 KB) (which contains the .exe file). The file attached is malicious and is a recent variant of a “downloader” that we have been seeing quite a bit lately. A downloader will simply open a backdoor on the target machine that can be used in the future to install one or multiple different types of malware.
There is a lot of confusion in the AV world about what is what. This is due to the fact that there are no standards between researchers and Anti-Virus companies, or anyone else for that matter, over naming conventions for the various aspects of malware and its delivery systems. Viruses and malware are often named after their behavior, or something that was pulled from their code, or sometimes even after the way they were received such as the Storm Worm who arrived attached to an email touting large storms in Europe. Sometimes a company will play nice and adopt someone else's name for a variant, but oftentimes these researchers are working on theses things at the same time and aren't aware of it's other labels, thus resulting in the same piece of malware having 7 different names across vendors.
The Beauty and the Geek reality television show that was often publicized as the "The Ultimate Social Experiment" is being used today as the “Ultimate Social Engineering Tactic”. This morning we began seeing a massive influx of zero day virus threat being sent via email. In all we saw at least seven different new variants of the same malware. The message that was coming in at the highest rate and certainly the most interesting of the group was a message claiming to be from the folks at the “Beauty and the Geek” show. The message claims that they are looking for contestants for the show and contains an attachment that you are instructed to open. The message attachment named [flyers.zip] contains malware identified as the Zbot Trojan. 
Since spammers have no “Rules of Engagement” they are always free to utilize any social engineering tactic that tickles their fancy. Despite the fact that 2009/2010 income tax year is fading away in the rearview mirror for most US citizens, cybercriminals are still [in mid-July] attempting to impersonate the IRS in order to infect your PC with malware.
ICANN 38 just ended this past week in Brussels Belgium, and several rather big announcements were made. Among those was the controversial decision to allow the .XXX TLD as a potential community site for the adult entertainment industry. As well as the addition of a new set of Chinese language internationalized domain names. The countries approved were China, Taiwan and Hong Kong. IDNs allow these countries access to the internet utilizing their own native Chinese script instead of having to use a Latin based character set which the Domain Name System was originally written in. This has brought about the new associated organizations - CCNIC (China Internet Network Information Center), HKIRC (Hong Kong Internet Registration Corporation Limited), and TWNIC (Taiwan Network Information Center).
The past few days have brought us a couple of different campaigns using multiple tricks in order to infect its victims with malware. The two most recent have disguised themselves as emailed purchase receipts. Yesterday it was Amazon.com, and today from Buy.com. The emails utilized graphics and looked better than most attempts. The fact that they do indeed look more believable may be enough to snare the reader into investigating their mystery purchase further. This would lead the recipient to one of several links in the email which all led to the same place, a domain hosted in Korea. After pausing at this page for a few seconds, the victim's browser would be redirected to another page where they would find themselves at the same old Canadian Pharmacy site. What they didn't see is that the miscreants were actually multi-tasking. While at the first domain, they were fed a malicious iframe that would attempt to download malware from yet a third site. The fact that the victim eventually ends up at the spam site could act as a clever cover tricking them into thinking that that's all that had happened. The malicious payloads recently have been specially crafted documents that attempt to exploit vulnerabilities in Adobe Acrobat and Java. Today I was unable to pull down any files from the site. Either they weren't there at the time or they are able to track what they deem to be excessive hits from one source to their site in order to prevent security professionals from seeing too much.
Because nothing says opportunity like your fellow human beings in distress… I bring you just one example of millions of messages with less than admirable intentions that we have been seeing throughout the days following the Gulf of Mexico Oil spill. 
Powered by Compendium Blogware