Spam trumpeting the power of love is nothing more than an old trick dressed up in new clothes, more evidence that the backers
of the Waledec bot Trojan are the same bunch that hammered users last year with Storm, security companies are warning.
Podcast: Dissecting the Storm Worm threat
After McColo takedown, spam surges again
Multiple security vendors, including MX Logic Inc. , Trend Micro Inc. and Panda Security, have issued alerts about new Valentine's Day-themed spam campaigns that try to dupe users into installing
the Waledec bot.
Subject lines for the spam, said Sam Masiello , vice president of information security at MX Logic, are "short and sweet," and include "Me and You," "In Your Arms" and
"With all my love." From the spam, users who browse to the embedded link reach a site with a dozen hearts, any one of which
download an executable file when clicked.
Masiello first noted the campaign last Thursday, but other researchers, including those at Trend Micro and Panda, picked up
on the trend Monday. Both Masiello and Florabel Baetiong, an anti-spam research engineer with Trend, noted the similarity
between the recent infection attempt and Valentine's Day scams launched last year by hackers controlling Storm, another bot Trojan that has since fallen into disuse, possibly because the crew responsible
surrendered to heavy pressure by security experts .
"Clearly the old Storm folks are working as hard as they can to build up their new botnet, and are following the old tried-and-true
methods of centering their social engineering tactics around holiday themes," said Masiello in a post to the MX Logic blog .
"But it still impresses me that tactics like this continue to work and be so effective, despite how many times it gets recycled,"
Masiello said in an interview today.
Storm used Valentine's Day spam in both 2007 and 2008 to hijack PCs.
Most researchers have come around to the idea that Waledec is, in fact, the new Storm. Joe Stewart , an expert on botnets -- Storm, in particular -- was confident that the group that backed Storm essentially re-wrote its
code to come up with Waledec. "If it's not the same people, they would have had to study Storm intensively to match the functionality,"
Stewart said in an interview recently. "It's so similar that it's unlikely to be a different group."
For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.
