Security Response

A recent reportindicates there is a newer, more sinister botnet that is setting itselfup to surpass the Storm worm. The botnet, called MayDay, is thought tobe more elusive and have a greater capacity for causing damage thanit's Storm worm counterpart. Symantec Security Response has come acrossa sample and has released a new detection named Trojan.Daymayto identify this malware. Computers protected by Symantec antivirusproducts were previously protected as the sample was detected asW32.Mytob.AA@mm.

Symantec has seen limited activity with respect to distribution ofthe sample, which is believed to have originally been spammed out bythe author(s). At the time of writing, the Trojan is serving up creditscore related spam. It is yet to be seen how successful the Trojan...

Symantec has observed active exploitationof a potential 0-day vulnerability in Xunlei Web Thunder. Thisvulnerability has been assigned BID 25192. This vulnerability is closely related to a previously discovered Xunlei vulnerability identified as BID 24552. Exploitation of this new vulnerability may result in arbitrary download of malicious files onto the compromised computer.

Symantec has observed an instance in which a copy of W32.Bratsters was downloaded. In addition to this malware detection, the IPS signature HTTP XunLei WebThunder ActiveX Download also detects the attempted exploitation.

Symantec recommends...