Waledac bot pitches nearby terrorist bombing to dupe users

Pitch customized for recipient's location for 'more compelling' trickery, says researcher

Hackers trying to trick users into downloading the Waledac Trojan are customizing their bait to the recipient's location, a security researcher said Tuesday, upping the social engineering ante yet again.

The latest round of spam messages from Waledac's makers trumpets news of a supposed bomb blast, said Paul Royal, principal researcher for Web security company Purewire Inc. The link included in the spam -- which comes armed with subject headings such as "Bomb was blasted in your town" and "At least 18 killed in your city" -- leads to a fake Reuters news service site, and a story that claims local fatalities from a bombing attack.

"Authorities suggested that the explosion was caused by a 'dirty' bomb," one version of the bogus site read. The site then uses the now-standard ruse of asking the user to download and install an update to Adobe System Inc.'s Flash Player to view video. The file is, of course, nothing of the sort, but is actually the Waledac Trojan horse.

"Within the last 24 to 48 hours, Waledac has switched to a fake Reuters news story," said Royal. In itself, that's nothing new: Attackers have leveraged current events to get users to download malware for years. "What's somewhat novel here is that the Waledac operators have added the notion of locality," he said.

"Either at the malware distribution point, or somewhere upstream from the user, they look at the IP address, use that to get your location, and then feed that into the news story so it says that the bomb blast was near a market in your city."

When Royal used an IP address in Chile, for example, he was served up with a link to a story that claimed the bombing had taken place in Santiago, that country's largest city and capital. "The content becomes more compelling," Royal said, when it poses as local news.

Waledac has become famous for using the cutting-edge social engineering tactics, one of the reasons why security researchers almost unanimously believe that its makers are from the group that operated the infamous Storm botnet last year.

"Storm's operators always chose to exploit things that were temporally relevant," said Royal. "And Waledac shows the same unique insight into using social engineering and what's current in the news."

Although Waledac has been active for several months, Royal noted that it has yet to build up a botnet that can rival Storm at its peak. "It's nowhere near as big," he said, noting that Purewire had pegged Storm as controlling as many as 400,000 PCs in late 2007. "It's harder to get an accurate number for Waledac," he admitted, "but our best guess is that it's in the 25,000 to 50,000 range."

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags terrorism

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?