Spam shot of 'Storm Trojan' reaches record proportions

Storm Trojan has already broken spam and virus records

A massive spam outbreak that tries to trick recipients into opening a file attachment that can hijack their computers has already broken records, security companies said Thursday.

According to researchers at Postini, the spam run is the largest in the last 12 months, and more than three times the volume of the two biggest in recent memory: a pair of blasts in December and January. "We're seeing 50 to 60 times the normal volume of spam," said Adam Swidler, senior manager of solutions marketing at Postini.

Arriving with subject headings touting Worm Alert!, Worm Detected, Spyware Detected!, Virus Activity Detected!, the spam carries a ZIP file attachment posing as a patch necessary to ward off the bogus attack. The ZIP file, which is password protected -- the password is included in the message to further dupe recipients -- actually contains a variant of the "Storm Trojan" worm, which installs a rootkit to cloak itself, disables security software, steals confidential information from the PC, and adds it to a bot army of compromised computers.

Irony, it seems, isn't lost on the attackers. "This is really a self-fulfilling prophecy," said Swidler, "by warning users about a worm attack to get them to click on a worm."

There's little funny about the attack. "We're seeing both a very high volume of spam and a self-replicating worm," said Swidler. "This combination is kind of sophisticated. It's technically sophisticated in how they package the payload, but also in how they're trying to fool users into clicking on the attachment."

The malicious spam, Swidler went on, tries to convince users that their computers are already infected with malware, and now part of a botnet. "They're telling people that their e-mail access is about to be cut off, and that they have to install this patch to continue using [e-mail]."

Postini has already counted nearly 5 million copies of the spam in the last 24 hours, and calculated that the run currently accounts for 87 percent of all malware being spread through e-mail. Spam rates have jumped as well; Postini said 79 percent of all e-mail is now spam, while rival MessageLabs reported a 13 percent jump in spam's slice of all messages in just one hour.

"Expect this to grow much larger," Swidler said. "It should top out at 60 million messages within the next 24 hours."

Worse, the malware bundled with the spam is self-replicating, so it's able to sniff out e-mail addresses on infected PCs and send copies of itself to those recipients. "There will be a fair number of additional infections," Swidler said. He warned that even when the spam campaign exhausts itself, the newly-compromised computers might be able to sustain large quantities of spam on their own.

The spam blast also includes a host of randomization and anti-detection features, other researchers said. "E-mails are randomized with different filenames, different passwords and different binaries within the ZIP file to evade detection," Ken Dunham, director of VeriSign's iDefense rapid response team, said in an e-mail. "And once executed, the worm communicates over a private peer-to-peer (P2P) network to update itself."

The latter is a long-time characteristic of the Storm Trojan family.

Because the Storm Trojan has been assigned several different names by anti-virus vendors, it's difficult to determine which security companies reacted first. Some, however, have already created new signatures to sniff out the malicious payload. Symantec, for example, noted the new strain on its Web site, but said there that it won't update customers with the detection fingerprint until Friday.

That may be too late for some users.

"It is highly likely that this latest attack will result in many more downloads, pump-and-dump attacks and more, as seen with former Storm Worm attacks," Dunham said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?