Researchers at Symantec found a fresh raft of domains hosting the malware, which leads to a series of browser exploits that attempt to infect the user.
However, the domains are not currently hosting any active pages and researchers have yet to link the domains to spam attacks, Storm's favourite method for claiming new victims.
"This is very unusual. It is also interesting to note the move from simply using social engineering techniques to spread malware, to actually exploiting vulnerabilities," wrote Symantec researcher Vikram Thakur.
"In the past, the Storm authors would directly link to malware on websites or within spam emails. The malware would not check for any particular vulnerability before planting its seed."
Discovery of the new domains comes just days after researchers first reported a 95 per cent drop in the Storm botnet.
Some researchers attributed the drop to improvements in security tools, while others posited that Storm was being pushed out in favour of the new Kraken botnet.
But it now appears that Storm is gearing up for another attack. Thakur mentioned a Mother's Day spam run or a round of iFrame injections as possible methods for an upcoming assault.
"Only time will allow the method employed in this wave of attacks to be confirmed," he said. "This is definitely an interesting development in the story of the Storm worm."
Storm clouds gather again
By
Shaun Nichols
on May 7, 2008 10:23AM
