Storm Worms exploit April Fools
Lazy attack aims to dupe the credulous
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The miscreants behind the Storm Worm botnet have taken advantage of April Fools' day in a bid to infect more Windows PCs.
Security firms are warning users to avoid the temptation to click on April Fools' day emails that may redirect them to maliciously constructed websites.
The latest attempt to dupe more gullible users into getting their PCs infected kicked off on Monday with a spam campaign designed to trick recipients into visiting websites under the control of hackers containing executables with names such such as foolsday.exe, Kickme.exe or funny.exe.
So far the miscreants punting the scam haven't even bothered to include exploit code, net security firm F-secure notes. Potential marks are simply invited to download the malware, promoted via a spam mail campaign.
These spam emails feature Subject Lines such as "April Fool’s Day" and an equally unimaginative choice of images.
Trend Micro reports that the miscreants behind the attack were too indolent to actually create their own image to represent the holiday, so they simply Googled "April Fools" and used the first image that showed up.
The creators of the Storm Worm have a history of using holidays and special events as lures for their malware. The last major Storm run was in the weeks leading up to Valentine's Day.
As before, the latest spam campaign is designed to infect new computers that will then become part of the larger Storm Worm botnet. These compromised PCs can then be hired out to spammers, miscreants interested in running denial of service attacks, adware distributors, and other internet denizens. ®
COMMENTS
@ b shubin
"most people will click on ANYTHING, especially if they are at work, and the PC they're using is provided and supported by someone else."
This just is not true anymore. SOME people will click on anything, but not most. A few years ago this would have had some truth in it but now people are well used to being bombarded with spam emails laden with viruses, most have probably had several viruses and systems cleaned after some stupid "clicking" and are now very wary about what they click.
Anyway - my point was, why send out something so mundane and uninviting as a one liner? Yes they will have gotten a few infections from it but no they will not have gotten more than a few hundred max.
You also have to realise that the email list they used, having been harvested from the infected hosts, probably numbers in 20+ million. However, these 20+ million have now been receiving storm emails for the best part of this year and are well aware of what they shouldnt click. On top of this they did not even use dyndns to at least make the IP address a domain and look a little more realistic.
Early this year the messages were slightly more believable, now it looks like someone with no knowledge of how best to generate mass infections is simply creating a quick http server on an infected host and sending a crappy mass spam out. All in all taking up 3 minutes of their time to create and send. This is not the same person who was clicking the send button on his bot hoard earlier this year...
"So they simply Googled "April Fools" and used the first image that showed up"
Lucky they didn't use the second image...
Suckers
Of course people are stupid. Just look at the comments to one of today's April Fool videos on http://www.youtube.com/watch?v=UcLcn7o8v7w
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
