Stephen Doherty's blog

Analysis: Kevin Savage

Contributor: Pavlo Prodanchuk

A wave of spam emails promoting a rally against newly elected president Vladimir Putin of Russia began around March 5. An attachment purporting to contain details of an upcoming anti-Putin demonstration accompanied email subjects with varying call-to-action lines:

Upwards of 20,000 stolen archives have been uploaded to a third party file-sharing site from hosts infected with a new threat called Infostealer.Offsupload. The following heatmap indicates the U.S. is the primary target of infection, however, only a few countries worldwide have managed to avoid the affect of this threat.

Adobe has issued a public advisory regarding a critical vulnerability (CVE-2011-2462) that affects:

Threat Analysis: Alan Neville

As word spreads of the death of Muammar Gadhafi, cybercriminals are starting to take advantage. We are already seeing spam campaigns related to his death with malicious attachments. Here are a couple of examples of what we have seen so far.

Analysis by Poul Jenson and Masaki Suenega
Spotted by Karthik Selvaraj

Here at Symantec Security Response we have discovered Python.Pytroj, a proof-of-concept virus that infects .pyc files with arbitrary code.

Technical analysis: Poul Jensen, Illustrations: Ben Nahorney

Malware authors move fast. Following on from the previous blog post on Bitcoin botnet mining, we have seen a recent Trojan in the wild targeting Bitcoin wallets.

There is currently a new spam campaign spreading across Facebook. The spam has an appearance similar to the following:

Recently at Symantec Security Response, we came across a seemingly innocuous program which was being hosted at a number of different URLs. What flagged the file as unusual was the fact many different customers were submitting the same file for analysis.