Threat Level: green Handler on Duty: Manuel Humberto Santander Pelaez

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Yet another round of Viral Spam

Published: 2009-10-15
Last Updated: 2009-10-15 14:29:53 UTC
by Deborah Hale (Version: 1)
3 comment(s)

Reports are coming in today regarding another round of spam attempting to spread malicious programs on machines all over the world. 

I just checked my Postini and I too am seeing these emails.  Here is the content of the new round:

You have (6) New Message from Outlook Microsoft<br /> <br /> - Please re-configure your Microsoft Outlook Again.<br /> - Download attached setup file and install.<br />

These emails contain an attachment.  The ones in my Postini filter contain an attachment with the name install.zip.  (This doesn't mean that is the only
name that is being used. )

According to the headers these emails are coming from IP addresses all over the world and are using various mailservers including servers from well
known services like Yahoo and GMail as well as private mail servers at private companies.

In addition to the Outlook spam we are seeing a new influx of IRS spam with an attachment tax-statement.exe, and of course the DHL Service spam.

Yesterday my company got hit with a round of the emails with OWA links.  We don't use Exchange for our external email so the link was "broken".  We
received a number of phone calls and emails from customers telling us they clicked on the link and it didn't work and asking what they should do now.  
Luckily the link was "broke" or we would have had a pretty nasty mess on our hands today.  The interesting thing about this was the email was sent to 
one email account with  "Dear another email account" and the users still clicked on the link. May wonders never cease. 

I find this unusual increase in virus spam emails rather ironic beings this is Security Awareness month.  Might be a good time to remind your
users about the dangers of clicking on links or attachments that they get in emails.  Make sure that they understand what the procedure is for reporting
these emails to your company or your security department.  

Deb Hale Long Lines, LLC

3 comment(s)
Diary Archives