Internet Domain Registry

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Sunday, 22 November 2009

Fake Flash Player Zbot spread by "Your Domain"

Posted on 05:26 by Unknown
The malware just keeps flowing! Today the top email-based threats continue to be related to the Zeus botnet or Zbot. The first we've written about previously in our article on November 18th, Zeus: Same Criminal, New Spam which discussed the malware which pretended to be "payment request from (insert company)" and contained a "module.zip" attachment. That campaign fell away finally about 4:15 Friday morning.

To replace it, we have the new version of the "Avalanche" spam. We've received 51,400 copies of this spam email so far. (Yes! The UAB Spam Data Mine is now growing by more than 1 million messages per day - more about that in the near future.) The new campaign lit up about 9:15 AM on Friday morning, and has been unstoppable since.

The email seems especially scary to recipients because it includes your own email address in the subject, and your own domain name as part of the URL to be visited. So, for instance, if your email address were "bugs@bunny.com", your subject lines would be:

dear owner of the bugs@bunny.com
for bugs@bunny.com owner
for bunny.com email service user
please update your bugs@bunny.com mailbox

And your email would read:
Dear owner of the bugs@bunny.com mailbox,
You have to change the security mode of your account, from standart to secure. Please change the security mode by using the link below:

http://accounts.bunny.com.dlsports.be/webmail/settings/noflash.php?mode=standart&id=5236183961831736912306248671355740858547&email=bugs@bunny.com


Even some security researchers thought that others were receiving spam using their company name as the site distributing the virus, but in reality each recipient of the spam email sees his own domain name as part of the website address to be visited.

For simplicity, we'll use "mydomain.com" when we document the websites below.

The webpage looks like this:



After warning that "You don't have the latest version of Macromedia Flash Player", the website offers the fairly standard "Get Adobe Flash Player" icon. In this case, however, instead of fetching from Adobe, it installs from the server you are visiting, from the path "/webmail/settings/flashinstaller.exe".

We've seen twenty-two different domains registered for this round of cybercrime. All of these sites are currently live:

accounts.mydomain.com.ftpddrs.be
accounts.mydomain.com.dlsports.be
accounts.mydomain.com.modertps.be
accounts.mydomain.com.dirddrf.be
accounts.mydomain.com.verzzi.co.uk
accounts.mydomain.com.verzzm.co.uk
accounts.mydomain.com.verzzn.me.uk
accounts.mydomain.com.verzzg.org.uk
accounts.mydomain.com.verzzm.org.uk
accounts.mydomain.com.verzzg.co.uk
accounts.mydomain.com.verzzq.me.uk
accounts.mydomain.com.verzzi.me.uk
accounts.mydomain.com.verzzn.co.uk
accounts.mydomain.com.verzzq.co.uk
accounts.mydomain.com.verzzn.org.uk
accounts.mydomain.com.verzzi.org.uk
accounts.mydomain.com.verzzg.me.uk
accounts.mydomain.com.verzzm.me.uk
accounts.mydomain.com.verzzq.org.uk

The VirusTotal report for flashinstaller.exe shows fairly decent detection with many brands calling this a "Zbot" variant.

The file we scanned was the currently live file:
File size: 123392 bytes
MD5 : f890afa3b55a64b70d45f1b1fc60a77b

Some folks have been confused by the great news from the Metropolitan Police of London this past week. Metropolitan Police's Central e-Crime Unit (PCeU) arrested a pair of twenty-year olds, one man and one woman, on November 3rd for their use of the Zeus bot. You can read more about that arrest in Jeremy Kirk's PC World article or in this Press Release on the Metro Police website.

While its terribly exciting news, and we congratulate all the fine folks at PCeU, they've only arrested one of the many groups distributing Zeus, and not "the big one". While Zeus or Zbot is best known as a stealer of banking credentials, its important to remember that ALL userids and passwords entered on a Zeus victim computer end up in the databases of criminals. Whether these be your email password, your Netflix password, your BestBuy or Dell or Amazon.com or eBay or Paypal, or any other password, it now belongs to the criminals, along with your Credit Card and Banking information.


Here are some of the places we're currently seeing these domains resolve:

ip | hostname
-----------------+-------------------------------------
114.47.126.158 | accounts.mydomain.com.dlsports.be
114.47.126.158 | accounts.mydomain.com.modertps.be
114.47.126.158 | accounts.mydomain.com.ftpddrs.be
114.47.126.158 | accounts.mydomain.com.dirddrf.be
116.34.65.11 | accounts.mydomain.com.verzzq.co.uk
116.34.65.11 | accounts.mydomain.com.verzzg.org.uk
116.34.65.11 | accounts.mydomain.com.verzzg.co.uk
116.34.65.11 | accounts.mydomain.com.verzzn.org.uk
116.34.65.11 | accounts.mydomain.com.verzzg.me.uk
116.34.65.11 | accounts.mydomain.com.verzzm.me.uk
116.34.65.11 | accounts.mydomain.com.verzzi.co.uk
116.34.65.11 | accounts.mydomain.com.verzzq.org.uk
116.34.65.11 | accounts.mydomain.com.verzzm.co.uk
116.34.65.11 | accounts.mydomain.com.verzzn.me.uk
116.34.65.11 | accounts.mydomain.com.verzzn.co.uk
116.34.65.11 | accounts.mydomain.com.verzzq.me.uk
116.34.65.11 | accounts.mydomain.com.verzzi.me.uk
116.34.65.11 | accounts.mydomain.com.verzzm.org.uk
116.34.65.11 | accounts.mydomain.com.verzzi.org.uk
117.102.44.55 | accounts.mydomain.com.verzzi.org.uk
117.102.44.55 | accounts.mydomain.com.verzzq.co.uk
117.102.44.55 | accounts.mydomain.com.verzzg.org.uk
117.102.44.55 | accounts.mydomain.com.verzzg.co.uk
117.102.44.55 | accounts.mydomain.com.verzzn.org.uk
117.102.44.55 | accounts.mydomain.com.verzzg.me.uk
117.102.44.55 | accounts.mydomain.com.verzzm.me.uk
117.102.44.55 | accounts.mydomain.com.verzzi.co.uk
117.102.44.55 | accounts.mydomain.com.verzzq.org.uk
117.102.44.55 | accounts.mydomain.com.verzzm.co.uk
117.102.44.55 | accounts.mydomain.com.verzzn.me.uk
117.102.44.55 | accounts.mydomain.com.verzzn.co.uk
117.102.44.55 | accounts.mydomain.com.verzzq.me.uk
117.102.44.55 | accounts.mydomain.com.verzzi.me.uk
117.102.44.55 | accounts.mydomain.com.verzzm.org.uk
118.171.100.18 | accounts.mydomain.com.dirddrf.be
118.171.100.18 | accounts.mydomain.com.dlsports.be
118.171.100.18 | accounts.mydomain.com.modertps.be
118.171.100.18 | accounts.mydomain.com.ftpddrs.be
118.32.132.193 | accounts.mydomain.com.dirddrf.be
118.32.132.193 | accounts.mydomain.com.dlsports.be
118.32.132.193 | accounts.mydomain.com.modertps.be
118.32.132.193 | accounts.mydomain.com.ftpddrs.be
119.202.26.228 | accounts.mydomain.com.dirddrf.be
119.202.26.228 | accounts.mydomain.com.dlsports.be
119.202.26.228 | accounts.mydomain.com.modertps.be
119.202.26.228 | accounts.mydomain.com.ftpddrs.be
121.96.119.92 | accounts.mydomain.com.dirddrf.be
121.96.119.92 | accounts.mydomain.com.dlsports.be
121.96.119.92 | accounts.mydomain.com.modertps.be
121.96.119.92 | accounts.mydomain.com.ftpddrs.be
122.163.117.150 | accounts.mydomain.com.ftpddrs.be
122.163.117.150 | accounts.mydomain.com.dirddrf.be
122.163.117.150 | accounts.mydomain.com.dlsports.be
122.163.117.150 | accounts.mydomain.com.modertps.be
123.201.38.247 | accounts.mydomain.com.ftpddrs.be
123.201.38.247 | accounts.mydomain.com.dirddrf.be
123.201.38.247 | accounts.mydomain.com.dlsports.be
123.201.38.247 | accounts.mydomain.com.modertps.be
123.236.191.162 | accounts.mydomain.com.verzzi.org.uk
123.236.191.162 | accounts.mydomain.com.verzzq.co.uk
123.236.191.162 | accounts.mydomain.com.verzzg.org.uk
123.236.191.162 | accounts.mydomain.com.verzzg.co.uk
123.236.191.162 | accounts.mydomain.com.verzzn.org.uk
123.236.191.162 | accounts.mydomain.com.verzzg.me.uk
123.236.191.162 | accounts.mydomain.com.verzzm.me.uk
123.236.191.162 | accounts.mydomain.com.verzzi.co.uk
123.236.191.162 | accounts.mydomain.com.verzzq.org.uk
123.236.191.162 | accounts.mydomain.com.verzzm.co.uk
123.236.191.162 | accounts.mydomain.com.verzzn.me.uk
123.236.191.162 | accounts.mydomain.com.verzzn.co.uk
123.236.191.162 | accounts.mydomain.com.verzzq.me.uk
123.236.191.162 | accounts.mydomain.com.verzzi.me.uk
123.236.191.162 | accounts.mydomain.com.verzzm.org.uk
186.81.205.197 | accounts.mydomain.com.verzzm.org.uk
186.81.205.197 | accounts.mydomain.com.verzzi.org.uk
186.81.205.197 | accounts.mydomain.com.verzzq.co.uk
186.81.205.197 | accounts.mydomain.com.verzzg.org.uk
186.81.205.197 | accounts.mydomain.com.verzzg.co.uk
186.81.205.197 | accounts.mydomain.com.verzzn.org.uk
186.81.205.197 | accounts.mydomain.com.verzzg.me.uk
186.81.205.197 | accounts.mydomain.com.verzzm.me.uk
186.81.205.197 | accounts.mydomain.com.verzzi.co.uk
186.81.205.197 | accounts.mydomain.com.verzzq.org.uk
186.81.205.197 | accounts.mydomain.com.verzzm.co.uk
186.81.205.197 | accounts.mydomain.com.verzzn.me.uk
186.81.205.197 | accounts.mydomain.com.verzzn.co.uk
186.81.205.197 | accounts.mydomain.com.verzzq.me.uk
186.81.205.197 | accounts.mydomain.com.verzzi.me.uk
187.10.65.176 | accounts.mydomain.com.ftpddrs.be
187.10.65.176 | accounts.mydomain.com.dirddrf.be
187.10.65.176 | accounts.mydomain.com.dlsports.be
187.10.65.176 | accounts.mydomain.com.modertps.be
187.67.255.47 | accounts.mydomain.com.verzzm.org.uk
187.67.255.47 | accounts.mydomain.com.verzzi.org.uk
187.67.255.47 | accounts.mydomain.com.verzzq.co.uk
187.67.255.47 | accounts.mydomain.com.verzzg.org.uk
187.67.255.47 | accounts.mydomain.com.verzzg.co.uk
187.67.255.47 | accounts.mydomain.com.verzzn.org.uk
187.67.255.47 | accounts.mydomain.com.verzzg.me.uk
187.67.255.47 | accounts.mydomain.com.verzzm.me.uk
187.67.255.47 | accounts.mydomain.com.verzzi.co.uk
187.67.255.47 | accounts.mydomain.com.verzzq.org.uk
187.67.255.47 | accounts.mydomain.com.verzzm.co.uk
187.67.255.47 | accounts.mydomain.com.verzzn.me.uk
187.67.255.47 | accounts.mydomain.com.verzzn.co.uk
187.67.255.47 | accounts.mydomain.com.verzzq.me.uk
187.67.255.47 | accounts.mydomain.com.verzzi.me.uk
189.101.130.181 | accounts.mydomain.com.verzzm.org.uk
189.101.130.181 | accounts.mydomain.com.verzzi.org.uk
189.101.130.181 | accounts.mydomain.com.verzzq.co.uk
189.101.130.181 | accounts.mydomain.com.verzzg.org.uk
189.101.130.181 | accounts.mydomain.com.verzzg.co.uk
189.101.130.181 | accounts.mydomain.com.verzzn.org.uk
189.101.130.181 | accounts.mydomain.com.verzzg.me.uk
189.101.130.181 | accounts.mydomain.com.verzzm.me.uk
189.101.130.181 | accounts.mydomain.com.verzzi.co.uk
189.101.130.181 | accounts.mydomain.com.verzzq.org.uk
189.101.130.181 | accounts.mydomain.com.verzzm.co.uk
189.101.130.181 | accounts.mydomain.com.verzzn.me.uk
189.101.130.181 | accounts.mydomain.com.verzzn.co.uk
189.101.130.181 | accounts.mydomain.com.verzzq.me.uk
189.101.130.181 | accounts.mydomain.com.verzzi.me.uk
189.105.69.79 | accounts.mydomain.com.verzzm.org.uk
189.105.69.79 | accounts.mydomain.com.verzzi.org.uk
189.105.69.79 | accounts.mydomain.com.verzzq.co.uk
189.105.69.79 | accounts.mydomain.com.verzzg.org.uk
189.105.69.79 | accounts.mydomain.com.verzzg.co.uk
189.105.69.79 | accounts.mydomain.com.verzzn.org.uk
189.105.69.79 | accounts.mydomain.com.verzzg.me.uk
189.105.69.79 | accounts.mydomain.com.verzzm.me.uk
189.105.69.79 | accounts.mydomain.com.verzzi.co.uk
189.105.69.79 | accounts.mydomain.com.verzzq.org.uk
189.105.69.79 | accounts.mydomain.com.verzzm.co.uk
189.105.69.79 | accounts.mydomain.com.verzzn.me.uk
189.105.69.79 | accounts.mydomain.com.verzzn.co.uk
189.105.69.79 | accounts.mydomain.com.verzzq.me.uk
189.105.69.79 | accounts.mydomain.com.verzzi.me.uk
189.68.28.51 | accounts.mydomain.com.ftpddrs.be
189.68.28.51 | accounts.mydomain.com.dirddrf.be
189.68.28.51 | accounts.mydomain.com.dlsports.be
189.68.28.51 | accounts.mydomain.com.modertps.be
189.99.176.72 | accounts.mydomain.com.ftpddrs.be
189.99.176.72 | accounts.mydomain.com.dirddrf.be
189.99.176.72 | accounts.mydomain.com.dlsports.be
189.99.176.72 | accounts.mydomain.com.modertps.be
190.128.153.40 | accounts.mydomain.com.ftpddrs.be
190.128.153.40 | accounts.mydomain.com.dirddrf.be
190.128.153.40 | accounts.mydomain.com.dlsports.be
190.128.153.40 | accounts.mydomain.com.modertps.be
190.245.105.180 | accounts.mydomain.com.ftpddrs.be
190.245.105.180 | accounts.mydomain.com.dirddrf.be
190.245.105.180 | accounts.mydomain.com.dlsports.be
190.245.105.180 | accounts.mydomain.com.modertps.be
200.86.147.219 | accounts.mydomain.com.verzzm.org.uk
200.86.147.219 | accounts.mydomain.com.verzzi.org.uk
200.86.147.219 | accounts.mydomain.com.verzzq.co.uk
200.86.147.219 | accounts.mydomain.com.verzzg.org.uk
200.86.147.219 | accounts.mydomain.com.verzzg.co.uk
200.86.147.219 | accounts.mydomain.com.verzzn.org.uk
200.86.147.219 | accounts.mydomain.com.verzzg.me.uk
200.86.147.219 | accounts.mydomain.com.verzzm.me.uk
200.86.147.219 | accounts.mydomain.com.verzzi.co.uk
200.86.147.219 | accounts.mydomain.com.verzzq.org.uk
200.86.147.219 | accounts.mydomain.com.verzzm.co.uk
200.86.147.219 | accounts.mydomain.com.verzzn.me.uk
200.86.147.219 | accounts.mydomain.com.verzzn.co.uk
200.86.147.219 | accounts.mydomain.com.verzzq.me.uk
200.86.147.219 | accounts.mydomain.com.verzzi.me.uk
201.165.241.127 | accounts.mydomain.com.verzzq.me.uk
201.165.241.127 | accounts.mydomain.com.verzzi.me.uk
201.165.241.127 | accounts.mydomain.com.verzzm.org.uk
201.165.241.127 | accounts.mydomain.com.verzzi.org.uk
201.165.241.127 | accounts.mydomain.com.verzzq.co.uk
201.165.241.127 | accounts.mydomain.com.verzzg.org.uk
201.165.241.127 | accounts.mydomain.com.verzzg.co.uk
201.165.241.127 | accounts.mydomain.com.verzzn.org.uk
201.165.241.127 | accounts.mydomain.com.verzzg.me.uk
201.165.241.127 | accounts.mydomain.com.verzzm.me.uk
201.165.241.127 | accounts.mydomain.com.verzzi.co.uk
201.165.241.127 | accounts.mydomain.com.verzzq.org.uk
201.165.241.127 | accounts.mydomain.com.verzzm.co.uk
201.165.241.127 | accounts.mydomain.com.verzzn.me.uk
201.165.241.127 | accounts.mydomain.com.verzzn.co.uk
201.226.135.11 | accounts.mydomain.com.verzzm.co.uk
201.226.135.11 | accounts.mydomain.com.verzzn.me.uk
201.226.135.11 | accounts.mydomain.com.verzzn.co.uk
201.226.135.11 | accounts.mydomain.com.verzzq.me.uk
201.226.135.11 | accounts.mydomain.com.verzzi.me.uk
201.226.135.11 | accounts.mydomain.com.verzzm.org.uk
201.226.135.11 | accounts.mydomain.com.verzzi.org.uk
201.226.135.11 | accounts.mydomain.com.verzzq.co.uk
201.226.135.11 | accounts.mydomain.com.verzzg.org.uk
201.226.135.11 | accounts.mydomain.com.verzzg.co.uk
201.226.135.11 | accounts.mydomain.com.verzzn.org.uk
201.226.135.11 | accounts.mydomain.com.verzzg.me.uk
201.226.135.11 | accounts.mydomain.com.verzzm.me.uk
201.226.135.11 | accounts.mydomain.com.verzzi.co.uk
201.226.135.11 | accounts.mydomain.com.verzzq.org.uk
210.4.118.70 | accounts.mydomain.com.ftpddrs.be
210.4.118.70 | accounts.mydomain.com.dirddrf.be
210.4.118.70 | accounts.mydomain.com.dlsports.be
210.4.118.70 | accounts.mydomain.com.modertps.be
220.66.118.214 | accounts.mydomain.com.ftpddrs.be
220.66.118.214 | accounts.mydomain.com.dirddrf.be
220.66.118.214 | accounts.mydomain.com.dlsports.be
220.66.118.214 | accounts.mydomain.com.modertps.be
24.139.111.53 | accounts.mydomain.com.verzzi.co.uk
24.139.111.53 | accounts.mydomain.com.verzzq.org.uk
24.139.111.53 | accounts.mydomain.com.verzzm.co.uk
24.139.111.53 | accounts.mydomain.com.verzzn.me.uk
24.139.111.53 | accounts.mydomain.com.verzzn.co.uk
24.139.111.53 | accounts.mydomain.com.verzzq.me.uk
24.139.111.53 | accounts.mydomain.com.verzzi.me.uk
24.139.111.53 | accounts.mydomain.com.verzzm.org.uk
24.139.111.53 | accounts.mydomain.com.verzzi.org.uk
24.139.111.53 | accounts.mydomain.com.verzzq.co.uk
24.139.111.53 | accounts.mydomain.com.verzzg.org.uk
24.139.111.53 | accounts.mydomain.com.verzzg.co.uk
24.139.111.53 | accounts.mydomain.com.verzzn.org.uk
24.139.111.53 | accounts.mydomain.com.verzzg.me.uk
24.139.111.53 | accounts.mydomain.com.verzzm.me.uk
24.42.38.115 | accounts.mydomain.com.verzzm.co.uk
24.42.38.115 | accounts.mydomain.com.verzzn.me.uk
24.42.38.115 | accounts.mydomain.com.verzzn.co.uk
24.42.38.115 | accounts.mydomain.com.verzzq.me.uk
24.42.38.115 | accounts.mydomain.com.verzzi.me.uk
24.42.38.115 | accounts.mydomain.com.verzzm.org.uk
24.42.38.115 | accounts.mydomain.com.verzzi.org.uk
24.42.38.115 | accounts.mydomain.com.verzzq.co.uk
24.42.38.115 | accounts.mydomain.com.verzzg.org.uk
24.42.38.115 | accounts.mydomain.com.verzzg.co.uk
24.42.38.115 | accounts.mydomain.com.verzzn.org.uk
24.42.38.115 | accounts.mydomain.com.verzzg.me.uk
24.42.38.115 | accounts.mydomain.com.verzzm.me.uk
24.42.38.115 | accounts.mydomain.com.verzzi.co.uk
24.42.38.115 | accounts.mydomain.com.verzzq.org.uk
41.249.1.157 | accounts.mydomain.com.verzzg.co.uk
41.249.1.157 | accounts.mydomain.com.verzzn.org.uk
41.249.1.157 | accounts.mydomain.com.verzzg.me.uk
41.249.1.157 | accounts.mydomain.com.verzzm.me.uk
41.249.1.157 | accounts.mydomain.com.verzzi.co.uk
41.249.1.157 | accounts.mydomain.com.verzzq.org.uk
41.249.1.157 | accounts.mydomain.com.verzzm.co.uk
41.249.1.157 | accounts.mydomain.com.verzzn.me.uk
41.249.1.157 | accounts.mydomain.com.verzzn.co.uk
41.249.1.157 | accounts.mydomain.com.verzzq.me.uk
41.249.1.157 | accounts.mydomain.com.verzzi.me.uk
41.249.1.157 | accounts.mydomain.com.verzzm.org.uk
41.249.1.157 | accounts.mydomain.com.verzzi.org.uk
41.249.1.157 | accounts.mydomain.com.verzzq.co.uk
41.249.1.157 | accounts.mydomain.com.verzzg.org.uk
41.249.3.188 | accounts.mydomain.com.verzzg.org.uk
41.249.3.188 | accounts.mydomain.com.verzzg.co.uk
41.249.3.188 | accounts.mydomain.com.verzzn.org.uk
41.249.3.188 | accounts.mydomain.com.verzzg.me.uk
41.249.3.188 | accounts.mydomain.com.verzzm.me.uk
41.249.3.188 | accounts.mydomain.com.verzzi.co.uk
41.249.3.188 | accounts.mydomain.com.verzzq.org.uk
41.249.3.188 | accounts.mydomain.com.verzzm.co.uk
41.249.3.188 | accounts.mydomain.com.verzzn.me.uk
41.249.3.188 | accounts.mydomain.com.verzzn.co.uk
41.249.3.188 | accounts.mydomain.com.verzzq.me.uk
41.249.3.188 | accounts.mydomain.com.verzzi.me.uk
41.249.3.188 | accounts.mydomain.com.verzzm.org.uk
41.249.3.188 | accounts.mydomain.com.verzzi.org.uk
41.249.3.188 | accounts.mydomain.com.verzzq.co.uk
59.95.168.192 | accounts.mydomain.com.ftpddrs.be
59.95.168.192 | accounts.mydomain.com.dirddrf.be
59.95.168.192 | accounts.mydomain.com.dlsports.be
59.95.168.192 | accounts.mydomain.com.modertps.be
85.108.73.82 | accounts.mydomain.com.verzzq.co.uk
85.108.73.82 | accounts.mydomain.com.verzzg.org.uk
85.108.73.82 | accounts.mydomain.com.verzzg.co.uk
85.108.73.82 | accounts.mydomain.com.verzzn.org.uk
85.108.73.82 | accounts.mydomain.com.verzzg.me.uk
85.108.73.82 | accounts.mydomain.com.verzzm.me.uk
85.108.73.82 | accounts.mydomain.com.verzzi.co.uk
85.108.73.82 | accounts.mydomain.com.verzzq.org.uk
85.108.73.82 | accounts.mydomain.com.verzzm.co.uk
85.108.73.82 | accounts.mydomain.com.verzzn.me.uk
85.108.73.82 | accounts.mydomain.com.verzzn.co.uk
85.108.73.82 | accounts.mydomain.com.verzzq.me.uk
85.108.73.82 | accounts.mydomain.com.verzzi.me.uk
85.108.73.82 | accounts.mydomain.com.verzzm.org.uk
85.108.73.82 | accounts.mydomain.com.verzzi.org.uk
Email ThisBlogThis!Share to XShare to Facebook
Posted in zbot | No comments
Newer Post Older Post Home

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Popular Posts

  • Happy New Year! Here's a Virus! (New Year's Postcard malware)
    I've been busy this week looking at the various defacements (see ComputerWorld , and ABC News ) and other cyber attacks (see yesterday...
  • From Russia, With Love . . . new Postcard spam spies on your PC
    Isn't it nice to have friends who send you postcards? The UAB Spam Data Mine is especially fortunate in that way. Beginning the evenin...
  • New Year's Waledac Card
    We haven't seen a new version of Waledac since Independence Day (July 4, 2009), but it looks like its back! I'm on vacation today, s...
  • Top Brands Imitated by Malicious Spam
    WebSense recently released an InfoGraphic titled "Top Five Subject Lines in Phishing Emails." for January 1, 2013 through Septemb...
  • Tempting Photo Attachments Lead to Fake AV
    One of today's largest malicious spam campaigns continued an occasional theme we've been seeing for a few weeks. A subject line, fo...
  • What about the Social Security Numbers? (The Utah Data Breach and your SSN)
    The Utah Data Breach This week the continuing saga of the Utah Medicaid Data Breach continued to unfold. If you haven't been following...
  • Stop the Rumors: Quit SMSing about WalMart Gang Initiations
    My daughter and her teenage friend were sitting on the couch watching TV today when they began getting text messages on their phone. Here...
  • Minipost: IPR Center celebrates Cyber Monday
    The National Intellectual Property Rights Center (IPR Center) announced today that in celebration of Cyber Monday, they have Seized 82 Domai...
  • ACH Spammer switches to Shortened URLs
    For many weeks now the spammers behind one particular malware family have been fighting a running battle to keep their malware-hosting domai...
  • Work at Home . . . for a Criminal?
    How do you tell if a "Work at Home" invitation is a scam? Here's a clue: It comes in your email. In today's Blog, I tho...

Categories

  • china
  • computer security careers
  • conficker
  • cyberwar
  • digital certificates
  • facebook
  • fake av
  • gumblar
  • koobface
  • law enforcement
  • malware
  • pharmaceuticals
  • phishing
  • public policy
  • spam
  • twitter
  • twitter malware
  • waledac
  • zbot

Blog Archive

  • ►  2013 (21)
    • ►  December (4)
    • ►  November (1)
    • ►  October (1)
    • ►  September (1)
    • ►  August (3)
    • ►  July (1)
    • ►  June (1)
    • ►  May (5)
    • ►  April (3)
    • ►  March (1)
  • ►  2012 (18)
    • ►  August (1)
    • ►  June (1)
    • ►  May (7)
    • ►  April (2)
    • ►  March (7)
  • ►  2011 (28)
    • ►  November (3)
    • ►  October (1)
    • ►  August (4)
    • ►  July (6)
    • ►  June (1)
    • ►  May (2)
    • ►  April (2)
    • ►  March (6)
    • ►  February (1)
    • ►  January (2)
  • ►  2010 (80)
    • ►  December (6)
    • ►  November (10)
    • ►  October (6)
    • ►  September (12)
    • ►  August (5)
    • ►  July (4)
    • ►  June (11)
    • ►  April (7)
    • ►  March (8)
    • ►  February (4)
    • ►  January (7)
  • ▼  2009 (92)
    • ►  December (12)
    • ▼  November (11)
      • IRS Spam Campaign leads to low detection malware
      • Beware Weekend Facebook Scam!
      • Some Jerk posted your photo - and now you're infec...
      • UAB Spam Data Mine finds Social Security Statement...
      • Fake Flash Player Zbot spread by "Your Domain"
      • Running out of Money Mules?
      • Zeus: Same Criminal, New Spam Infrastructure
      • Newest Zeus = NACHA: The Electronic Payments Assoc...
      • The $9 Million World-Wide Bank Robbery
      • Zeus / Zbot Malware moves Back to IRS
      • Zeus Malware Moves to Myspace
    • ►  October (16)
    • ►  September (7)
    • ►  July (5)
    • ►  June (10)
    • ►  May (2)
    • ►  April (6)
    • ►  March (7)
    • ►  February (6)
    • ►  January (10)
  • ►  2008 (101)
    • ►  December (7)
    • ►  November (17)
    • ►  October (11)
    • ►  September (10)
    • ►  August (22)
    • ►  July (12)
    • ►  June (3)
    • ►  May (7)
    • ►  April (5)
    • ►  March (2)
    • ►  February (1)
    • ►  January (4)
  • ►  2007 (31)
    • ►  December (3)
    • ►  November (9)
    • ►  October (3)
    • ►  September (2)
    • ►  August (5)
    • ►  July (5)
    • ►  January (4)
  • ►  2006 (5)
    • ►  December (2)
    • ►  October (3)
Powered by Blogger.

About Me

Unknown
View my complete profile