Researchers at Symantec found a fresh raft of domains hosting the malware, which leads to a series of browser exploits that attempt to infect the user.
However, the domains are not currently hosting any active pages and researchers have yet to link the domains to spam attacks, Storm's favourite method for claiming new victims.
"This is very unusual. It is also interesting to note the move from simply using social engineering techniques to spread malware, to actually exploiting vulnerabilities," wrote Symantec researcher Vikram Thakur.
"In the past, the Storm authors would directly link to malware on websites or within spam emails. The malware would not check for any particular vulnerability before planting its seed."
Discovery of the new domains comes just days after researchers first reported a 95 per cent drop in the Storm botnet.
Some researchers attributed the drop to improvements in security tools, while others posited that Storm was being pushed out in favour of the new Kraken botnet.
But it now appears that Storm is gearing up for another attack. Thakur mentioned a Mother's Day spam run or a round of iFrame injections as possible methods for an upcoming assault.
"Only time will allow the method employed in this wave of attacks to be confirmed," he said. "This is definitely an interesting development in the story of the Storm worm."
Storm clouds gather again
By
Shaun Nichols
on
May 7, 2008 10:23AM
Just days after reports of the possible demise of Storm, the worm has again set off security alarm bells.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers
Free eBook: Digital Transformation 101 – for banks
Why financial services need to tackle their Middle Office
Learn: The latest way to transfer files between customers
Extracting the value of data using Unified Observability
Planning before the breach: You can’t protect what you can’t see