Security Response

Thanks to Anand Muralidharan for their assistance with this research.

Televison channels across the world are set to be at the 14th International Exhibition and Forum, World Content Show, held Feb 7- 9, 2012, in Russia. The exhibition showcases the latest technologies and trends in the TV and telecommunication industry.

This techno-fair will be attended in large numbers by leading media businesses, and spammers don’t want to miss the opportunity to circulate spam around the event. In a bid to catch the reader’s attention, one such spam email reveals some appealing facts about the event, such as Interactive Elements, Prize Drawings, Performance of Popular Leader/Star, and Colorful Musical Concerts.

Here is an example of this Russian spam observed by Symantec:

Here are the subject...

At 3 AM, on February 6, 2012, Symantec Security Response observed spam carrying malicious links which target the upcoming tax season. The spam volume spiked between 6 AM and 1 PM, identifying over 200 unique URLs which lead to a Blackhole toolkit.

A Blackhole toolkit compromises the machine by targeting various vulnerabilities on the victim's machine. Symantec protects our customers with multiple-layer protection of antispam, antivirus, and IPS signatures. The payload downloaded from the malicious website is detected as Trojan.Zbot, for instance, and IPS detects this web attack as “Web Attack: Blackhole Toolkit Website 14” and “...

You may not need pills to watch the super bowl but spammers feel that this definitely  is an occasion to do so! The most exciting annual championship of the NFL -  the Super Bowl XLVI - starts tomorrow. And as expected, spammers are playing a different ball game with the crazy Super Bowl fans.

Spam related to Super Bowl  can be spotted with the subject listed below:

Subject: Super Bowl [BRAND NAME] Sale
Subject: Super Bowl Special
Subject: Super Bowl
Subject: Super Bowl 2012 - You win no matter which team does!

One such spam sample that we discovered promotes an online pharmacy. The email offers a free generic combo pack after placing medical orders with them.

The link in the spam sample goes to the following online pharmacy site:

Another...

Spam levels always rise when a holiday or special event approaches. Symantec researchers are observing a surge of spam as Valentine’s Day gets closer and closer. Unbelievable discounts on jewelry, dinners, and expensive gift articles are the key themes for the Valentine’s Day related spam. Further popular fake promotions include: online pharmaceuticals, fake e-cards, gift cards, chocolates, and flowers. The purpose of these fake promotions is to capture a user’s personal and financial details.

Valentine’s Day related spam can easily be spotted by observing the “From” header as shown below:

• From: "Valentine's Berries" <info@
• From: "Valentine's Bouquets" <info@
• From: "Valentine's Gifts" <info@
• From: "Valentine's Presents" <info@
• From: "...