Hot on the heels of their quick Christmas campaign, the Storm Worm team is back with a New Year’s theme. This time they’re using two new domains (shown in order of appearance):
uhavepostcard.com
happycards2008.com
newyearcards2008.com
Emails look basically like you would expect them to:
Date: Thu, 27 Dec 2007 05:20:11 +0100
From: aaa1@prevencionfremap.es
To: jose@arbor.net
Subject: New Year Postcard
Happy New Year To […]
The Storm Worm is back, this time it’s got a Christmas theme. Who knew that it would take them so long to do this? Here’s a sample mail:
Date: Sun, 23 Dec 2007 21:19:19 -0500
From: geneoldham@usmint.treas.gov
To: —
Subject: Find Some Christmas Tail
got a sec?
Winter can be cold. I bet you could use a little something to warm […]
Overnight I got a handful of “Person X has written you a scrapbook entry” mails from Orkut, Google’s social network. Not just spams claiming to be from Orkut, and not a Phishing attack. I got suspicious, this sort of thing suggested a malware attack on Orkut (a’la the Samy XSS worm on MySpace). But, […]
I’ve been looking at politically motivated DDoS events for some time now, geopolitics has always fascinated me. This has been a hot topic for some time, really kicked into high gear earlier this year with the Estonian DDoS events. Recently there was a DDoS against the site for Ukraine President Viktor Yushchenko. With this […]
UPDATED to link to the F-Secure name map …
This year the Storm Worm (aka Peacomm aka Nuwar aka Tibs aka Zheltin), but we should not forget about good old Stration, the spam botnet that preceded Storm.
With Storm stealing all of the thunder this year, people seemed to think that Stration was whipped. Far from […]
