Video Screencast Help
Security Response
Showing posts tagged with Spam
Showing posts in English
Dermot Harnett | 05 Nov 2008 21:24:21 GMT | 0 comments

While the U.S. voters have now been heard and are welcoming their new president, it is important for us to remember that the spam campaign is certainly not over. Spam levels averaged in at 76.4 percent of all messages in October 2008. This spam level represents a year-on-year increase of nearly six percent since October 2007.


Over the last year, Symantec has been monitoring spam related to the U.S. presidential campaign. It all began 12 months ago when spammers cast their first votes for Republican nominee Ron Paul. With spam subject lines such as “IRS Fears Ron Paul?”, it was certainly an early indication that it was going to be an interesting year for spam related to the presidential campaigns. February 2008 saw a round of bogus links to Hillary Clinton videos that were cloaking a malicious Trojan. This tactic emulated a popular technique being used by spammers to link malicious code and spam. This trend continued in amongst other types of spam...

Dermot Harnett | 05 Nov 2008 12:26:25 GMT | 0 comments

As the gut-wrenching roller coaster that world economies have experienced over the last 90 days continues, it is not surprising that spammers are still attempting to tap into the economic angle to try and deliver their spam messages. Spammers often use the “issue du jour” in their spam campaigns. To borrow a phrase coined by strategists for Bill Clinton in 1992 and apply it to today’s issue: "It's the economy, stupid."

Just like Angelina Jolie, Brad Pitt, Paris Hilton, and Britney Spears, the U.S. Treasury Secretary (Henry Paulson) has joined the list of spammers’ favorite “celebrities.” In October 2008, Symantec observed a spam attack that contained a message claiming to come from the U.S. Treasury Secretary. The message suggested that Paulson had been instructed by the United Nations to "wire a sum of $1m into your Bank Account in a Legal way." [sic] In addition to this attack, Symantec also discovered that the FDIC...

Kelly Conley | 15 Oct 2008 12:47:16 GMT | 0 comments

Symantec has observed an increase in the use of image spam attacks over the past few weeks. Symantec defines image spam as an unsolicited message containing an image in the body.

In August, image spam attacks accounted for approximately 1.6% of total spam. In September we observed that image attacks almost doubled, representing approximately 2.6% of total spam. Over 50% of image attacks observed are English, and the second largest group of messages is Russian. In the first ten days of October, image spam messages have averaged approximately 8.6% of total spam. This is the highest mark to date over the last 90 days. From May of this year up to September, image spam was relatively quiet. As stated above, these numbers have been increasing since mid-September. We have not seen image spam of this volume since February of this year.

Commonly seen image spam messages have included Russian online dating offers, random product offerings with an image opt-out, and the all too...

Kelly Conley | 06 Oct 2008 19:14:26 GMT | 0 comments

The trend of spam messages containing URL links to malicious code and/or carrying malicious payloads has dramatically spiked since May of this year. This trend is the focus of our October State of Spam Report, issued today. From June to mid September, the amount of malicious code detected in scanned email messages increased from a tenth of a percent (0.1%) in June to 1.2 % in the middle of September. Now, that doesn’t sound like much, but consider that this represents a 12x increase! The top ten of definitions detected by antivirus rules for this period were led by generic Trojan, Downloader, and Infostealer definitions—making up more than 30% of the malicious code detected.

Also noted in this month’s State of Spam Report is the increase in zombie activity. The report notes that while zombie activity decreased from July to August, it increased more than 100% between August and September. For this period, the EMEA region was the leading source of all zombie IP addresses....

Kelly Conley | 10 Sep 2008 16:34:38 GMT | 0 comments

We have observed a fraudulent spam attack masquerading as an email from Symantec. This email is in Portuguese and contains the Symantec logo and coloring, which make it appear as a legitimate email from Symantec. The “From” line is forged to add further credibility. The “Subject” and “From” lines appear as follows:


Subject:  Security Check
From: SYMANTEC <Worm@bda.267>

Needless to say, this is not from Symantec. The body of the message contains text that indicates that the Symantec Security Check System has tested your computer and found “X” number of dangerous imperfections. The email goes on to say that your computer is infected with the virus “Worm@bda.267.” Users are encouraged to click the provided link to download updates to protect their systems from further damage from this worm. Incidentally, there is no such virus as Worm@bda.267.

If the...

Kelly Conley | 04 Sep 2008 14:38:23 GMT | 0 comments

In August, the "Internet" category of spam showed an increase of nine percent from July and now makes up 27% of all spam messages. This increase is detailed in the Symantec State of Spam Report for September, which will be released today. The escalation of Internet spam can be attributed to the prevalence of malicious code being sent around via spam emails over the past month. It seems that spammers will stop at nothing to deliver their payload-various techniques in spam containing viruses were observed over "the month of the virus." These include the following methods:

  • Sensationalized "fake" news headlines
  • Use of seemingly real news headlines
  • Purported download for the latest version of Internet Explorer
  • Malware + spam + phishing = The triple security threat for financial institutions
  • Airline e-ticket connects malicious code and spam

Sensational (and in many cases...

Kelly Conley | 03 Sep 2008 17:34:51 GMT | 0 comments

The theme to Flash Gordon is going through my head. You can't hear it, but I can. He's the savior of the universe, king of the impossible, and he'll save ev'ry one of us.

These lyrics seem so appropriate when it comes to all of the .swf (Flash) spam that we're observing. I imagine the spammer looks upon .swf files as saving his spam by ensuring it will bypass filters. Is .swf the "king of the impossible," able to avoid detection? The answer is "no."

What we have observed are spam messages that contain a link to an .swf file. This file is hosted on a popular image hosting site. When clicked, the link redirects to various Web sites and so far we've seen medical supplement and adult-oriented sites as the destination of the redirects.

The .swf attack with the largest volume observed is the German pharmacy attack, with over 300 million instances seen. The body of this message is in German and includes a list of medications that are...

Kelly Conley | 29 Aug 2008 17:58:32 GMT | 0 comments

Notice! The virus-spreading spammer doesn't have your baby but is claiming to. In recent emails observed by Symantec, malicious code is being spread by hoax emails claiming to have pictures of your hijacked [sic] baby. The Subject line makes the claim that someone has  "hijacked" your baby and the attachment on the message is not a photo, but rather a zip file containing a downloader:

Subject: We have hijacked your baby
Content-Type: application/zip;        name=""

The body will look similar to the following:

"Hey We have hijacked your baby but you must pay once to us $50 000. The details we will send later...
We has attached photo of your fume"

The email comes with an attached zip file called "," which...

Candid Wueest | 27 Aug 2008 17:59:48 GMT | 0 comments

I must admit that I was puzzled for a second when I saw an email with a suicide note as a subject line in my spam inbox. I wondered what product they might try to sell with that note or which drive-by download site might be hidden behind it. So, I opened it. The email was actually written like a real suicide note.

In the text of the message, a young Swiss guy explains that he has had enough with the world and that he has given up his painful fight against the Russian cyber-criminals. With some side notes, he explains that he had at least profited a little from their own tricks and was able to transfer some cash for himself from Swiss online banking accounts. Of course, he explains, all in the name of the greater good.

The mail then takes a tangent and tells a story about him catching his girlfriend red-handed with another guy, which finalized his...

Kelly Conley | 21 Aug 2008 07:20:52 GMT | 0 comments

In the past few days Symantec has observed virus spam masquerading as news articles regarding the current Georgia-Russia conflict. We felt it was important to blog about this because this particular event is garnering a lot of media attention and holds a very high profile. Because of this, there is an extremely high potential for the spreading of malicious code by spam email using information on this event as a lure.

The messages themselves contain an attachment, along with instructions and passwords for the download of the attachment. The subject line appears to be a legitimate news story about the Russia/Georgia conflict. One subject line that has been seen reads: “Subject: Journalists Shot in Georgia.” A short description of a “news event” related to the Russia-Georgia conflict is contained within the body of the message.

The use of the attention-grabbing subject line seems to be intended as a social engineering tactic to entice recipients to click the link...