Phishing scams target Waco explosion

Malicious tactics that exploited the Boston marathon bombing have switched to the explosion in Waco, Texas.

According to research by Websense Security Labs, tactics have been altered so that where Monday's bombing in Boston was the common term in malicious links and phishing messages, they now relate to the explosion in Texas.

Malicious links had been detected by a number of virus labs relating to the Boston bombing, with one suggestion that 234 malicious domains had been spotted.

Websense senior security researcher Carl Leonard said that the malicious campaign had quickly evolved to match the latest news from the Texas fertilizer plant explosion.

He said: “The emails are similar, but use texas.html instead of boston.html path. Subjects lines include: Texas Plant Explosion; Texas Explosion Injures Dozens; and Caught on Camera: Fertilizer Plant Explosion. The lure pages have updated titles, but the rest is similar.”

In the attack, if the recipient attempts to open the attachment they are redirected to an exploit page and then malware is downloaded to the victim's desktop and remote commands send and receive data.

Websense said that rather than using a dropper file, which contains the malicious code within itself and often packed to prevent detection by anti-virus signatures, this campaign uses a downloader belonging to the Win32/Waledac family that is used to download further malicious binaries.

“In this case, two bots named Win32/Kelihos and Troj/Zbot are downloaded and installed on the compromised machine in order to join it to the cyber criminals' bot network,” Leonard said.

“We continue to see cyber criminals use tragic events to exploit people's thirst for information and their eagerness to help those affected. It's important for businesses to recognise that without the right level of protection, their employees could be accessing emails or websites that could ultimately give the bad guys access to their corporate network.”

This article originally appeared at scmagazineuk.com