Dealing with swine flu malware outbreak

By Victor Ng | May 8, 2009

1 comments

Delicious

Digg

Email

Print

Cybercriminals are again taking advantage of worldwide news events to seed their Trojans. This time, they are cashing in on the worldwide hysteria over swine flu by offering bogus swine flu survival guides, fake drugs or collecting “donations” to peddle malware and steal credit card details.

“This has happened with every single major news piece since at least 2005, ranging from the Katrina hurricane to Barack Obama's election and, of course, the bird flu alerts of 2006,” noted Guillaume Lovet, senior manager of the EMEA Threat Response Team at Fortinet Technologies.

The threats
Romana Ward of SophosLabs discovered swine flu comment spam messages urging members of a Russian pharmaceutical network to sell a cure for the disease. The network sells legitimate generic drugs. The message urges affiliates to add Oseltamivir, a generic form of Tamiflu, to their store catalog.

A similar campaign was waged during the bird flu outbreak, Ward said.

One of the more serious spam messages contains a malicious PDF file that purports to provide information about the swine flu. When users access the “Swine influenza frequently asked questions.pdf” file, malcode within the PDF tries to drop another piece of malware -- Infostealer or Trojan.Bloodhound.6 -- onto the users’ system.

If a victim opens the file, their machine is immediately infected with a Trojan, which tries to steal sensitive data, said Kevin Haley, director of security response at Symantec.

This social engineering trick is not only used in pure executable Trojan distribution campaigns (a la "click me"), but also in Search Engine Optimization (SEO) attacks, said Fortinet’s Lovet.