SPAM frauds, fakes, and other MALWARE deliveries - archive

[AplusWebMaster]

FYI...

Scams - Economic Stimulus email and websites...
- http://www.us-cert.gov/current/#econ...il_and_website
March 5, 2009 - "... economic stimulus scams circulating. These scams are being conducted through both email and malicious websites. Some of the email scam messages request personal information, which can then be used for identity theft. Other email scam messages offer to deposit the stimulus funds directly into users' bank accounts. If users provide their banking information, the attackers may be able to withdraw funds from the users' accounts. The website scams entice users by claiming that they can help them get money from the stimulus fund. These websites typically request payment for their services. If users provide their credit card information, the attackers running the malicious sites may make unauthorized charges to the card, or charge users more than the agreed upon terms..."
- http://ftc.gov/opa/2009/03/stimulusscam.shtm

[AplusWebMaster]

FYI...

Fake Windows Support SPAM... Info-Stealer
- http://blog.trendmicro.com/fake-wind...-info-stealer/
Mar 9, 2009 - "... Spammed email messages were found pretending to come from Microsoft Windows Support and claiming that Microsoft Service Pack 1 and Service Pack 2 have been discovered to have an error that can damage the computer’s software or even the hardware. These messages encourage users to download and install a file in order to fix the problem. When users click the download button they are redirected to a site and are asked to download a file which Trend Micro detects as TROJ_DLOADER.CUT... TROJ_DLOADER.CUT connects to a certain URL to download another malicious file, which in turn is detected by Trend Micro as TSPY_BANKER.MCL. TSPY_BANKER.MCL monitors the affected user’s online transactions and steals banking related information. Not too many TSPY_BANKER variants have been reported to be related to notable attacks recently, and this incident may pretty much mark the end of the hiatus. Users are advised to ignore spammed messages and, more importantly, to never click links embedded in these messages..."

(Screenshot available at the URL above.)

[AplusWebMaster]

FYI...

- http://preview.tinyurl.com/dn8vkj
March 9, 2009 PandaLabs blog - "Today we're announcing results of a study that analyzed 67 million computers in 2008 and revealed that 1.1 percent of the worldwide population of Internet users have been actively exposed to identity theft malware. We predict that the infection rate will increase by an additional 336 percent per month throughout 2009, based on the trend of the previous 14 months. Here are the highlights from our study on the evolution of online identity theft:
• Over three million of the audited users in the U.S. and more than 10 million users worldwide were infected with active identity theft-based malware last year.
• 1.07% of all PCs scanned in 2008 were infected with active malware (resident in memory during the scan) related to identity theft, such as banker Trojans.
• 35% of the infected PCs had up-to-date antivirus software installed.
• The number of PCs infected with identify theft malware increased by 800 percent from the first half of 2008 to the second half.
• Arizona, California and Florida continue to be the states with the highest per-capita incidence of reported identity theft.
Active malware means malware that is loaded into the PC's memory and actively running as a process. For example, users of PCs infected with this type of identity theft malware who utilize online services such as shopping, banking, and social networking, have had their identities stolen in some fashion. According to the Federal Trade Commission (FTC), the average time victims spend resolving identity theft issues is 30 hours per incident. The cumulative cost in hours alone from identity theft related malware based on Panda Security's projected infection rate could reach 90 million hours..."

[AplusWebMaster]

FYI...

- http://blog.trendmicro.com/tinyurl-p...oming-popular/
Mar. 13, 2009 - "... We previously blogged about similar phishing operations that used this exact technique to trick users into thinking links are legitimate:
• http://blog.trendmicro.com/not-so-tiny-phishing/
• http://blog.trendmicro.com/tinyurl-n...n-im-phishing/
...Substituting preview.tinyurl.com* for tinyurl.com also allows users to get a preview of the final link."

* http://tinyurl.com/preview.php
"Don't want to be instantly redirected to a TinyURL and instead want to see where it's going before going to the site? Not a problem with our preview feature..."

[AplusWebMaster]

FYI...

Malicious spam run(s), again...
- http://www.f-secure.com/weblog/archives/00001625.html
March 13, 2009 - "The type of spam runs we saw late last year (Obama and BofA) are starting to pick up again in volume. We've seen Classmates being used as a theme and two days ago it was fake Facebook messages. Today it's back to fake Bank of America certificates... As in all previous spam runs it leads to a site prompting you to download a fake Adobe Flash player. This malware steals confidential information and sends it to a web server. In previous attacks this server was in Ukraine but it has now been moved to Hong Kong. If you see network traffic to the IP address 58.65.232.17 it's a bad sign."

(Screenshot available at the URL above.)

[AplusWebMaster]

FYI...

- http://securitylabs.websense.com/con...erts/3321.aspx
03.16.2009 - "Websense... has detected yet another new Waledac campaign theme in the wild. The new variant uses a Reuters theme as a social engineering mechanism to report a bogus news item relating to a 'bomb explosion'. The malicious Web sites in the current attack are socially engineered to report the geolocation of the incident corresponding to the user's IP address. They encourage users to view a video supposedly related to the news report. When users click on the video or the link below the video, they are advised to download the latest version of Flash Player. This leads to the download of Waledac variants. The theme includes legitimate links corresponding to Wikipedia and Google which are presented in a 'Related Links' section of the attack Web sites. Those legitimate links are used to target unsuspecting users in order to increase chances of success with the attack..."

- http://blog.trendmicro.com/waledac-l...l-engineering/
Mar. 16, 2009

- http://www.sophos.com/security/blog/2009/03/3541.html
15 March 2009

(Screenshots available at each URL above.)

[AplusWebMaster]

FYI...

- http://blog.trendmicro.com/online-ri...-down-economy/
Mar. 17, 2009 - "...TrendLabs reports more than a twenty-fold (2000 percent) increase in web threats between the beginning of 2005 and the end of 2008... for 2008 over 90 percent of all digital threats arrive at their targets via the Internet... from January until November 2008, a staggering 34.3 million PCs were infected with botnet-related malware..."

Trend Micro 2008 Annual Threat Roundup and 2009 Forecast
- http://us.trendmicro.com/imperia/md/...at_roundup.pdf
3.26MB PDF file

[AplusWebMaster]

FYI...

SPAM - fake Comcast, Facebook e-mails
- http://www.f-secure.com/weblog/archives/00001630.html
March 19, 2009 - "...new SPAM run that's going on. It's from the same group that used Bank Of America as the lure late last week and Northern Bank on Monday. Today it's Comcast and it might actually have a higher success rate then the previous run as users always want faster broadband, especially if there's no fee involved. And the page looks really convincing. Once installed the malware does the same as in the other spam runs - steals data and sends it to Hong Kong...
Update: The spam run was just changed to a Facebook scheme.
Some subjects are:
• FaceBook message: Magnificent girl dancing video clip (Last rated by Sal Velasquez)
• FaceBook message: Dancing Girl Drunk In The Pub- facebook Video (Last rated by Abe Bain)
• FaceBook message: Hot Girl Dancing At Striptease Dance Party (Last rated by Lowell Clay)
• FaceBook message: Dancing Girl Drunk In The Pub- facebook Video (Last rated by Shane Lucas)..."

YouTube e-mail link...
- http://www.f-secure.com/weblog/archives/00001629.html
March 19, 2009 "YouTube is once again being used as a lure to spread malware. Some clown is sending out e-mails... if you follow the link, this one actually uses a Java applet (complete with a fake signature) to push a variant of Parite to the machines..."

Death exploited by hackers...
- http://www.sophos.com/blogs/gc/g/200...eath-exploited
March 19, 2009 - "Cybercriminals don't waste any time these days jumping on the coat-tails of breaking news stories in their attempt to infect as many computer users as possible. This time it's the tragic death of award-winning English actress Natasha Richardson, who died yesterday after suffering head injuries in a skiing accident earlier in the week. It appears that hackers are stuffing webpages with keywords - most likely scraping the content off legitimate news websites - in order to lure unwary surfers into visiting their dangerous sites and infecting their computers... of course, if you do visit the malicious web link a malicious script will run on your computer... that then runs a fake anti-virus product designed to scare you into making an unwise purchase. Fake anti-virus products, also known as scareware or rogueware, are one of the fastest growing threats on the internet, and attempt to frighten you into believing that your computer has a security problem and that you should purchase a solution from the very people who have tricked you..."

(Screenshots available at each URL above.)

[AplusWebMaster]

FYI...

Ghostnet - targeted attacks
- http://www.f-secure.com/weblog/archives/00001637.html
March 29, 2009 - "University of Toronto published today a great research paper on targeted attacks. We've talked about targeted attacks for years. These cases usually go like this:
1. You receive a spoofed email with an attachment
2. The email appears to come from someone you know
3. The contents make sense and talk about real things (and in your language)
4. The attachment is a PDF, DOC, PPT or XLS
5. When you open up the attachment, you get a document on your screen that makes sense
6. But you also get exploited at the same time
7. The exploit drops a hidden remote access trojan, typically Grey Pigeon or Gh0st Rat variant
8. No one else got the email but you
9. You work for a government, a defense contractor or an NGO ...
But the real news is that Greg Walton & co actually managed to get an inside view of some of the servers used in these spying attacks. This means they got to see what was being done with the infected machines and where in the world they were... The release of the paper was synchronized with the New York Times article*. University of Cambridge released a related research paper at the same time as well. The Cambridge paper goes all the way to point the finger directly at the Chinese Government. Most other parties, us included, have not done such direct accusations without concrete proof of government involment... here are selected blog posts on the topic:
• Several examples of what the attack documents looked like
- http://www.f-secure.com/weblog/archives/00001406.html
• The mystery of Sergeant "nbsstt"
- http://www.f-secure.com/weblog/archives/00001449.html
• How we found the PDF generator used in some of these attacks
- http://www.f-secure.com/weblog/archives/00001450.html ..."

* http://www.nytimes.com/2009/03/29/technology/29spy.html

(Original document - scribd.com )
- http://preview.tinyurl.com/d5q3cj
Mar, 28, 2009 - "This report documents the GhostNet - a suspected cyber espionage network of over 1,295 infected computers in 103 countries, 30% of which are high-value targets, including ministries of foreign affairs, embassies, international organizations, news media, and NGOs..."

[AplusWebMaster]

FYI...

- http://www.marshal.com/TRACE/traceit...esection=trace
April 1, 2009
"...Spam
... by the end of March 2009 the SVI (Spam Volume Index) had reached its pre-McColo level. Even so, taking a longer term view, spam volume still remains less than mid-2008. We believe successive events, including the interruption of the Atrivo/Intercage network in September, the FTC crackdown of the ‘Affking’ gang in October, the McColo shutdown in November and the subsequent demise of the Srizbi botnet, and disruption to the Bobax botnet in late 2008, have all contributed to make life more difficult for spammers...
Botnets
... a handful of botnets continue to dominate the distribution of spam. At the end of March 2009, the familiar botnets Mega-D and Rustock and Pushdo continued to dominate spam production. Xarvester is the new kid on the block, and shares quite a few similarities to its likely predecessor, Srizbi. Add a second tier of botnets, namely Donbot, Grum and Gheg, and collectively, this motley group accounts for over 70% of spam...
Malicious Spam Campaigns
... The Waledac botnet, the probable successor to Storm, has been active with a range of campaigns including President Obama, Valentines, fake coupons and bomb blast news stories. The Pushdo botnet, too, continues to pump out various malicious spam and phishing email, including fake facebook.com and classmates.com campaigns...
Malicious Web Campaigns... (Rogue AV, etc.)
The last few months has seen the resurgence of the fake anti-virus purveyors, which have been part of the scene in one form or another for the best part of 12 months. Most recently, search engine optimization, using hot Google search terms*, is being used to drive users to websites where they are prompted to download, install, and pay for this dubious ‘anti-virus’ software...."
* http://www.marshal.com/trace/traceitem.asp?article=884