The Storm Worm gang are spreading seasonal ill-will. Security watchers have spotted New Year greeting spam runs that attempt to direct recipients to a malicious web site called uhavepostcard.com.

Anti-virus firm F-Secure warns (http://www.f-secure.com/weblog/archives/00001350.html) that although the site remains free of exploits (for now) the spam run is likely to be a prelude for a New Year's Eve-themed Storm Worm attack.

Malware miscreants are making early preparations for the New Year after they left it too late for Christmas, only striking on Christmas Eve. A widely-circulated email first distributed on December 24 pointed to a website containing a malicious Santa Claus-themed striptease.

The emails, which have varied subject lines including "Your Secret Santa", "Santa Said, HO HO HO", "Warm Up this Christmas" and "Mrs. Clause Is Out Tonight!" attempt to entice prospective marks into visiting a website containing images of scantily clad young women in a Santa suits. The images and “Download for free now!” button both linked to a variant (http://www.sophos.com/security/analyses/w32dorfae.html) of the Storm Worm, anti-virus firm Sophos reports.

The Internet Storm Centre is tracking the latest variant of ongoing Storm Worm attacks here (http://isc.sans.org/diary.html?storyid=3784).

The Storm Worm malware strain first surfaced in January, in emails attempting to trick users into visiting maliciously-constructed websites under the guise of messages offering information about the storms ravaging Europe at the time.

Over recent months crackers have refined their tactics. Emails punting the malware now contain fake links to YouTube, for example. Hackers have also attempted to trick users into visiting maliciously-constructed websites via login confirmation spam or bogus electronic greeting card receipts.

The attack methodology - tricking users into maliciously constructed websites that attempt to load botnet clients onto vulnerable PCs - has remained much the same. ®

Related stories

Storm Worms exploit April Fools (1 April 2008)
http://www.theregister.co.uk/2008/04/01/april_fool_storm_worm/
Russian FSB 'protecting' Storm Worm gang (31 January 2008)
http://www.theregister.co.uk/2008/01/31/storm_worm_protection/
Storm Worm turns one (18 January 2008)
http://www.theregister.co.uk/2008/01/18/storm_worm_botnet/
Network down? Must be New Year's Eve gunfire (4 January 2008)
http://www.theregister.co.uk/2008/01/04/raccoon_gunshots_downtime/
PC scuppers NYE fireworks in Seattle (2 January 2008)
http://www.theregister.co.uk/2008/01/02/seattle_fireworks_computer_glitch/
Celebrity spam gang whips up a storm (28 November 2007)
http://www.theregister.co.uk/2007/11/28/celebrity_spam_botnet/
Trick or trojan - watch out for Halloween malware (31 October 2007)
http://www.theregister.co.uk/2007/10/31/halloween_storm_spam/
Storm Worm retaliates against security researchers (25 October 2007)
http://www.theregister.co.uk/2007/10/25/storm_worm_backlash/
The balkanization of Storm Worm botnets (15 October 2007)
http://www.theregister.co.uk/2007/10/15/storm_trojan_balkanization/
Storm Worm linked to spam surge (14 September 2007)
http://www.theregister.co.uk/2007/09/14/storm_worm_analysis/
ISPs turn blind eye to million-machine malware monster (10 September 2007)
http://www.theregister.co.uk/2007/09/10/isps_ignore_strorm_worm_and_other_malware/
Storm Worm of a thousand faces (21 August 2007)
http://www.theregister.co.uk/2007/08/21/mutating_storm_worm/
Storm worm authors switch tactics (20 August 2007)
http://www.theregister.co.uk/2007/08/20/storm_vxers_refine_tactics/
Fake e-cards signal massive DDoS attack (7 August 2007)
http://www.theregister.co.uk/2007/08/07/storm_worm_spike/
Fast flux foils botnet takedown (11 July 2007)
http://www.theregister.co.uk/2007/07/11/fast_flux_botnet/
Rival malware gangs wage turf war (1 July 2007)
http://www.theregister.co.uk/2007/07/01/malware_gang_war/
Stormy weather for malware defenses (7 March 2007)
http://www.theregister.co.uk/2007/03/07/storm_malware_defenses/
Imperfect Storm aids spammers (19 February 2007)
http://www.theregister.co.uk/2007/02/19/storm_worm_stockpatrol/
Anatomy sheds new light on Storm Worm (9 February 2007)
http://www.theregister.co.uk/2007/02/09/storm_worm_anatomy/