Storm botnet connected to phishing ring

By

An investigation has uncovered a link between a recent phishing operation and the infamous Storm worm..

Storm botnet connected to phishing ring
Security experts believe that the botnet of infected PCs is now being leased out by its operator to other criminal groups.

Researchers at security firm F-Secure uncovered the connection while investigating a group of phishing sites posing as UK bank Halifax.

The company found that the hosting of the phishing domain was being passed around among a number of IP addresses.

When researchers cross-checked the addresses with other domains, they found domains as 'hellosanta2008.com' and 'postcards2008.com' which had been linked to fraudulent greeting cards used to spread the Storm worm over the holiday season.

The findings suggest that the operators of the Storm botnet are now allowing the network of infected machines to be accessed by other groups for various criminal activities.

"We have not seen this before. But we have been expecting something along these lines," said F-Secure chief research officer Mikko Hyppönen in a blog posting.

F-Secure is among many security firms to warn that Storm could become a commercial entity in 2008.

Researchers fear that Storm's computing power could be rented out for various criminal activities.

Storm first appeared in early 2007, circulating malware disguised as film of flooding in Europe. Since then, the controllers have used everything from spam runs to fake greeting cards to snare victims.

Experts warn that the tactics used to build and operate Storm could become a model for future botnets.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?