Security Response

Upwards of 20,000 stolen archives have been uploaded to a third party file-sharing site from hosts infected with a new threat called Infostealer.Offsupload. The following heatmap indicates the U.S. is the primary target of infection, however, only a few countries worldwide have managed to avoid the affect of this threat.

Infostealer.Offsupload is being used as part of a blended threat. The initial stage of the attack is an email purporting to come from FedEx with a malicious attachment: “FedEx_Invoice.exe”.

Once executed, this Trojan (detected as Trojan.Gen.2) contacts a command-and-control (C&C) server in order to download...

Adobe has issued a public advisory regarding a critical vulnerability (CVE-2011-2462) that affects:

• Adobe Reader X (10.1.1) and earlier versions for Windows and Macintosh
• Adobe Acrobat X (10.1.1) and earlier versions for Windows and Macintosh
• Adobe Reader 9.4.6 and earlier
• 9.x versions for UNIX

This critical vulnerability has recently been seen exploited in the wild in targeted attack emails sent on November 1st and 5th. This attack leverages the zero-day vulnerability in order to infect target computers with Backdoor.Sykipot.

We have seen Backdoor.Sykipot used in targeted attacks since January, 2010 and this is...

Threat Analysis: Alan Neville

As word spreads of the death of Muammar Gadhafi, cybercriminals are starting to take advantage. We are already seeing spam campaigns related to his death with malicious attachments. Here are a couple of examples of what we have seen so far.

This particular campaign claims that Muammar Gadahfi’s death may not be true. The attachment is a malicious help file that contains Backdoor.Misdat as the payload.

Another example follows, but the attachment was corrupt. Thus, an unsuspecting user would not, in fact, have infected their computer if they had attempted to open the attached archive.

We expect to see many more of these emails over the next few days, typically with...

Analysis by Poul Jenson and Masaki Suenega
Spotted by Karthik Selvaraj

Here at Symantec Security Response we have discovered Python.Pytroj, a proof-of-concept virus that infects .pyc files with arbitrary code.

In case you are unfamiliar with Python here is a brief description. Python is a programming language which can run on most major operating systems. Python scripts have the extension .py and, once executed, create .pyc files—Python compiled files.

So a quick test to see how it works!

We can see in the screenshot below that we have three files:

1. exploit.py
2. b.py
3. c.py

When we import the files via the “python –c” command the files are interpreted, run, and the .pyc files are generated....