May 4, 2000 is a date that has gone down in history for Symantec Hosted Services, then MessageLabs. On that day the MessageLabs Intelligence team was the first to stop and name the LoveBug virus, a mass-mailing worm that affected 45 million computer users when virus levels surged overnight from 1 in every 1000 emails to 1 in 28. Most of the insight into the sentiment of that day is in the accounts from those who were on the front lines of detection as told in the April 2010 MessageLabs Intelligence Report. Similarly, the only essence of the virus itself is left in its pictorial image which Symantec Hosted Services has captured using LoveBug’s actual virus code.  

Image generated by Alex Dragulescu using actual LoveBug virus code

This unique representation of the LoveBug virus was featured this week at InfoSec in...

By Martin Lee, Senior Software Engineer, Symantec Hosted Services

A common tactic of scammers is to exploit the desire of individuals to do good while doing well – to associate themselves with good works while making a little money. In the process these individuals become money mules, unwitting participants in the shadow economy.

One recent scam email purports to be from the Red Cross in Norway looking to recruit volunteers in India to process payments. Volunteers are offered a commission of 7% from the sums of money that they process and are offered up to $500/month. In reality, the email is from organised cyber criminals looking to recruit people to launder money stolen from attacks on bank accounts or from scams.

Criminals need to recruit networks of money mules who unknowingly accept transfers of stolen money into their bank accounts then transfer the money on to bank accounts controlled by the criminals. Often the money transfers are cross border,...

by Tony Millington, Associate Software Engineer, and Dan Bleaken, Malware Data Analyst, Symantec Hosted Services

A few days ago Symantec Hosted Services released its March Messagelabs Intelligence Report, which was picked up by a number of other technology news sites. We were quite surprised that they seemed to pick up on the information we published about the location of the sender. This is nothing new, really. We've used this information for a long time in various facets of our detection to facilitate more accurate judgments on the nature of a potentially harmful email.

The data published in the Messagelabs Intelligence report (http://www.messagelabs.com/mlireport/MLI_2010_03_M...) in regards to the source of the targeted attacks we intercept, is in a good proportion of all the targeted attacks we...

By Dan Bleaken, Malware Data Analyst, Symantec Hosted Services

MessageLabs Intelligence analysts found a 419 scam today that is a little different from the majority of 419s.

The basic premise of a 419 scam (also commonly referred to as an advance fee fraud scam) is that the recipient is entitled to, or has won a large sum of money, and in order to get the money, they need to contact someone (usually a webmail address but sometimes a phone number), or email personal details to a webmail address.  

As well as it being highly likely that the recipient’s email address would then be added to the  scammers’ list of targets (lining up the recipient for many more scam emails in future), the next stage would almost certainly be for the scammers to phone or email back, to get the victim to send an advance fee, in order to release the supposed money.  As is so often the case with advance fee fraud scams or 419s, the initial email is just the...