Is a New Year's Storm a’brewin?

After a quiet “Storm” front overThanksgiving, the Peacomm gang may be trying to make up for it now. Therecent Spam run, offering Mrs. Clausestrip shows, demonstrates that they are back to using their adeptsocial engineering techniques to dupe people into infecting theircomputers.

However, the Peacomm gang doesn’t seem content with their recentspam run and have launched a new one. Symantec is currently observing aspam run to celebrate New Years, 2008. Below is a list of some subjectlines seen in the latest Spam run:

• A New 2008 Year song
• A New Year song
• A brand New 2008 Year
• A brand New Year
• A fun packed New Year 2008 bash
• A new beginning, a new dawn!
• As the New 2008 Year...
• As the New Year...
• As you embrace another New Year 2008
• Blasting New 2008 Year
• Blasting New Year
• Blasting New Year 2008
• Get all set for a brand New 2008 Year
• Get all set for a brand New Year
• Get all set for a brand New Year 2008
• Greeting you the earliest with my heartiest New Year wishes Happy 2008 To You!
• Happy 2008!
• Happy New Year To You!
• Happy New Year To [email address]!
• Happy New Year!
• Have a fun filled and blasting New Year 2008!
• It's the New Year
• It's the longest of the year...
• Joyous New Year 2008
• Let's fete a sparkling New Year!
• Lots of greetings on New 2008 Year
• Message for New Year 2008
• New 2008 Year Postcard
• New 2008 Year Wishes
• New 2008 Year wishes for you
• New Hope and New Beginnings...
• New Year 2008 Ecard
• New Year Greeting Card
• New Year Postcard
• Opportunities for the New Year
• Ringing you up to wish a Happy New Year
• Sparkling and happy all through the New 2008 Year [DOMAIN]
• Sparkling and happy all through the New Year
• Sparkling wishes on the New Year 2008
• Special New 2008 Year Wish
• The New Year has arrived To the tune of celebration.
• A very happy New Year 2008 To the tune of celebration.

Contained in the email is a URL to one of several possible Websites. What is interesting is the number of recently registered domainsinvolved in this spam run. It looks like another Clause family member-“Larry Clause”- has been very busy over the past few days, registeringa number of domains with NIC.RU to aid the spam run. So far we haveobserved the following sites all involved in the spam run with mostbeing registered to a Larry Clause:

• familypostcards2008.com
• freshcards2008.com
• happy2008toyou.com
• happycards2008.com
• happysantacards.com
• hellosanta2008.com
• hohoho2008.com
• newyearcards2008.com
• newyearwithlove.com
• parentscards.com
• postcards-2008.com
• Santapcards.com
• Santawishes2008.com

If clicked on the user is presented with a plain page with the following text:

Your download should begin shortly. If your download does notstart in approximately 15 seconds, you can click here to launch thedownload and then press Run. Enjoy!

Their use of fast fluxhosting on botnets makes it very difficult to stop the hosting of thisrisk. The payload comes in the form of one of two files,Happynewyear2008.exe or Happy_2008.exe, both are variants of Symantec’sTrojan.Peacom.D detection.

As we have warned in the past, be very cautious of opening greetingcards, especially from people you do not know. Always keep yourantivirus software up-to-date and follow safe computing practices.

A happy & cautious new year to all.

Update 01-03-2008
Symantec Security Response has identified the following additional subjects:

• 2008 Rocks!
• A brand New 2008 Year
• A fresh New 2008 Year
• A fresh New Year
• A fresh New Year 2008
• A fun packed New 2008 Year bash
• A fun packed New Year bash
• A New 2008 Year song
• A new beginning in the New 2008 Year
• A new beginning in the New Year
• A new beginning in the New Year 2008
• A New Year 2008 song
• As the New 2008 Year...
• As you embrace another New 2008 Year
• As you embrace another New Year
• Dance to the New 2008 Year tune
• Dance to the New Year 2008 tune
• Dance to the New Year tune
• Greeting you the earliest with my heartiest New 2008 Year wishes
• Greeting you the earliest with my heartiest New Year 2008 wishes
• Happy New Year 2008 to the one I love
• Have a funfilled and blasting New 2008 Year!
• Have a funfilled and blasting New Year!
• Here comes a year young
• It's the New 2008 Year
• It's the New Year 2008
• Joyous New 2008 Year
• Joyous New Year
• Let's fete a sparkling New Year 2008!
• Let's fete a sparkling New Year!
• Lots of greetings on New Year
• Lots of greetings on New Year 2008
• Message for New 2008 Year
• Message for New Year
• New 2008 Year Ecard
• New 2008 Year Greeting Card
• New Year 2008 Greeting Card
• New Year 2008 Postcard
• New Year 2008 Wishes
• New Year 2008 wishes for you
• New Year Ecard
• New Year Wishes
• New Year wishes for you
• Opportunities for the New 2008 Year
• Opportunities for the New Year 2008
• Ringing you up to wish a Happy New 2008 Year
• Ringing you up to wish a Happy New Year 2008
• Sparkling and happy all through the New 2008 Year
• Sparkling and happy all through the New Year 2008
• Sparkling wishes on the New 2008 Year
• Sparkling wishes on the New Year
• Special New Year 2008 Wish
• Special New Year Wish
• The New 2008 Year has arrived
• The New Year has arrived
• Time to cheer!
• To the tune of celebration. A very happy New 2008 Year
• To the tune of celebration. A very happy New Year
• To the tune of celebration. A very happy New Year 2008
• Wishes for the New 2008 Year
• Wishes for the New Year