If anyone's noticed any strange email lately, say in the past 2 months, claiming that the package you just tried to send never made it, by UPS or FedEx, or perhaps with a receipt for airline tickets you never purchased, loan contracts, business deals, a letter from the US Customs office, rental contracts, receipts thanking you for your $8000+ dollar mortgage payment, or perhaps any of the aforementioned in a German or French version,...you're surely not alone.
All of these have been pummeling email servers pretty much non-stop for the past month and a half, and they are all related in the sense that they are all being delivered by the same group/botnet. Early reports by Marshal told us that the Pushdo botnet was responsible for the first few, but no one has really placed blame since, so it makes me wonder, but I'm still sticking with Pushdo until I'm given proof to the contrary, since all of them do have that trademark early Pushdo style. That is, simple to-the-point type social engineering emails with the virus attached, as opposed to a link to the malware like the Storm Worm employs.
At any rate, virus levels are at an all time high, as far as traffic's concerned, and most of it is courtesy of this latest malware campaign. As you'll note from the chart below, you'll see the total number of virii quarantined here at AppRiver over the past year broken down in a month to month view. Wow, that's some crazy traffic! And to think this month isn't even over yet, and we're already up about 1600% from our average virus capture rates.
The really tough thing for AV companies with these recent attacks is the response time. At the time these things start with a new variant, very few Anti-Virus companies are able to detect them, and if they do, it's with heuristic scanning, but that has still been very rare. It has taken hours in some cases for some of even the biggest AV's to push signatures down to their subscribers, and by the time they do, the campaign is usually over and the next one has started. With anywhere from 2 to 4 variants a day on average from this thing, that's a ton of leakage. Luckily here at AppRiver, we're able to shut them down much faster as we have a very manual approach, wherein, once we see a new campaign begin, we can take the sample and write a very quick byte-level signature, and place it directly into place so it will begin protecting clients immediately, as opposed to having to wait for your AV company's client-side software to receive a new defintion push.
It may look ugly out there, but fear not, we've got your back, I hate being self-promoting, or a braggard, but hey, it is Friday. I'm not sure what that means exactly, but I'm sticking to it.
In an article by the BBC today, NASA confirms that a trojan virus designed to steal passwords and login information for online games such as World of Warcraft, has found its way onto the International Space Station. Many of these games are popular mostly in Asia, such as Maple Story, HuangYi Online, and Talesweaver. This virus didn't even have to pay as much as Lance Bass did to the Russians before they denied his flight! The trojan known as Gammima.AG traveled to space on a laptop that was going to be used for official space business by an American astronaut. It originally made it onto this laptop by way of an infected USB thumb drive, at least that's their guess.
Posts
