Feeds

Sober infected PCs spew right-wing 'hate spam'

Neo-botnet

  • alert
  • submit to reddit

High performance access to file storage

Virus writers turned PCs infected with the Sober-P worm into relay stations for right-wing propaganda using backdoor access into compromised machines to load malicious code.

Sober-Q was downloaded from Saturday (14 May) onwards onto computers infected by recent Sober-P worm. The mass mailing Sober-P worm tricked recipients into thinking they had won tickets to the 2006 World Cup football tournament, duping numerous victims since its first appearance on 2 May.

Sober-Q doesn't spread itself via e-mails (even though it's been lumped with the Sober worm family it lacks any self-replicating function, so it's not a virus). The malware is essentially a spam engine - bulk mailing links to websites with right-wing German nationalistic content to domains with suffixes '.de', '.ch', '.at' or '.li'. Sober-Q also spams messages in English to domains outside the German-speaking world.

Examples of Sober-Q subject lines include: "Multi-Kulturell = Multi-Kriminell" (Multi-culturally = multi-criminally); "Dresden 1945" and "The Whore Lived Like a German".

"Spam has been traditionally regarded as annoying messages that promote Viagra, porn and low cost mortgages," said Scott Chasin, CTO of email security firm MX Logic. "But for the past year we have seen a trend in which worm authors are using spam not to hawk goods, but as a tool for political propaganda."

In June 2004, a spambot network used PCs infected by another variant of the Sober worm to disseminate political spam in one of the first attacks of its kind. The spread of the hate mail spam messages generated by Sober-Q coincides with ongoing celebrations throughout Europe this week marking the 60th anniversary of the end of World War II in Europe. ®

Related stories

Sober worm shakes Windows security
Sober worm speaks with forked tongue
Sober email worm gives Windows users the DTs
FBI issues Sober notice over Windows worm
World Cup worm gives Windows users the willies

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.