Original URL: https://www.theregister.com/2007/12/27/storm_worm_seasonal_attacks/
New Year's Eve greetings disguise Storm Worm attacks
Happy New malware
Posted in Channel, 27th December 2007 11:28 GMT
The Storm Worm gang are spreading seasonal ill-will. Security watchers have spotted New Year greeting spam runs that attempt to direct recipients to a malicious web site called uhavepostcard.com.
Anti-virus firm F-Secure warns that although the site remains free of exploits (for now) the spam run is likely to be a prelude for a New Year's Eve-themed Storm Worm attack.
Malware miscreants are making early preparations for the New Year after they left it too late for Christmas, only striking on Christmas Eve. A widely-circulated email first distributed on December 24 pointed to a website containing a malicious Santa Claus-themed striptease.
The emails, which have varied subject lines including "Your Secret Santa", "Santa Said, HO HO HO", "Warm Up this Christmas" and "Mrs. Clause Is Out Tonight!" attempt to entice prospective marks into visiting a website containing images of scantily clad young women in a Santa suits. The images and “Download for free now!” button both linked to a variant of the Storm Worm, anti-virus firm Sophos reports.
The Internet Storm Centre is tracking the latest variant of ongoing Storm Worm attacks here.
The Storm Worm malware strain first surfaced in January, in emails attempting to trick users into visiting maliciously-constructed websites under the guise of messages offering information about the storms ravaging Europe at the time.
Over recent months crackers have refined their tactics. Emails punting the malware now contain fake links to YouTube, for example. Hackers have also attempted to trick users into visiting maliciously-constructed websites via login confirmation spam or bogus electronic greeting card receipts.
The attack methodology - tricking users into maliciously constructed websites that attempt to load botnet clients onto vulnerable PCs - has remained much the same. ®