Security researchers at Cisco Systems and Solera Networks are reporting tax spam being used to spread the Zeus Trojan.
Zeus is down off malware's
and infecting PCs yet again, this time using a tax scam being
spammed out by attackers as bait.
Using the Oct. 15 tax filing extension deadline as a ruse, the malware has
been up to its old tricks, targeting banking and other user information. The
spam typically comes with the subject lines "LAST NOTICE: Your Federal Tax
Payment has been rejected in system" or "Your Tax Payment ID:
0103778341 has been rejected. Urgent Report information."
According to researchers at Cisco Systems, the spam campaign at one point on
Oct. 15 accounted for more than a third
of all spam on the Web.
"There is a link in the e-mail that, on its surface, appears to link to
the EFTPS [Electronic Federal Tax Payment System] Website," explained
Solera Networks CTO Joe Levy. "However,
when the user clicks on the link they actually get redirected several times to
various malware sites which attempt to download payloads specific to the user's
Victims end up getting infected with Zeus v2. The Zeus Trojan has been the
center of some media attention lately due to the
arrests of dozens
of people around the world recently on cyber-crime
charges. Popular among attackers because of its effectiveness, Zeus remains in
widespread use in the cyber-underground, security researchers have said.
The latest attack came from domains registered in Russia,
and came in two waves. After dropping off last night, it spiked at around 34
percent of all spam at 15:00 hours UT
today. According to Cisco Senior Security Researcher Henry Stern, the spam run
appears to be done, and whatever botnet was involved has probably moved on to
In addition to Zeus, a keylogger was installed to track keystrokes on an
infected system and send information to cyber-criminals. When users log on to
the legitimate EFTPS Website, the information transmitted to the attackers via
the keylogger can range from bank account numbers to the name, phone number and
address of a business.
"The timing of the attack seems to correspond with business tax filing
season," Levy added. "This makes it particularly targeted at small
and medium businesses."