Hackers dupe users with spam about bogus US-Iran war

Fake footage of a US led strike against Iran infects users with a Trojan virus

A weekend spam run tried to dupe recipients into downloading the infamous "Storm Trojan" by attaching files that posed as videos of a bogus missile strike by the U.S. against Iran, antivirus vendors said Monday.

The unsolicited e-mail, which arrives with provocative subject lines that include "Missle [sic] Strike: The USA kills more then [sic] 20000 Iranian citizens," "USA Declares War on Iran," and "USA Just Have Started World War III," include attached executable files such as video.exe and readme.exe, said Symantec.

"The underlying threats are actually nothing new," said Symantec researcher John McDonald on the company's security response team's blog. "They are simply minor variants of Trojan.Peacomm and W32.Mixor, which have been repacked in an attempt to avoid existing detection and appear to have been largely successful at that." Symantec added that executable file attached to the war-scare spam is actually a worm that downloads and install both Trojan horses.

According to data from MessageLabs, Peacomm -- also known as Zhelatin -- was the most prevalent piece of malware in the past 24 hours. It accounted for 32% of all malicious code being distributed worldwide, said MessageLabs.

By early today, other security companies, including F-Secure, Fortinet, Kaspersky Lab and Sophos, had released updated signatures to detect the tweaked threat.

Peacomm, which also goes by the nickname "Storm Trojan," is notable because an outbreak in January and February ended up claiming the prize as the biggest malware assault since mid-2005.

Previous spam runs of the malware have enticed users with romantic subject headings around Valentine's Day; the malicious code has been spread through blogs and instant messaging as well as e-mail.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

More about FortinetF-SecureKasperskyMessageLabsSophosSymantec

Show Comments