Zeus Trojan Spreads with Tax Spam

Security researchers at Cisco Systems and Solera Networks are reporting tax spam being used to spread the Zeus Trojan.

Zeus is down off malware's Mount Olympus and infecting PCs yet again, this time using a tax scam being spammed out by attackers as bait.

Using the Oct. 15 tax filing extension deadline as a ruse, the malware has been up to its old tricks, targeting banking and other user information. The spam typically comes with the subject lines "LAST NOTICE: Your Federal Tax Payment has been rejected in system" or "Your Tax Payment ID: 0103778341 has been rejected. Urgent Report information."

According to researchers at Cisco Systems, the spam campaign at one point on Oct. 15 accounted for more than a third of all spam on the Web. 

"There is a link in the e-mail that, on its surface, appears to link to the EFTPS [Electronic Federal Tax Payment System] Website," explained Solera Networks CTO Joe Levy. "However, when the user clicks on the link they actually get redirected several times to various malware sites which attempt to download payloads specific to the user's environment."

Victims end up getting infected with Zeus v2. The Zeus Trojan has been the center of some media attention lately due to the arrests of dozens of people around the world recently on cyber-crime charges. Popular among attackers because of its effectiveness, Zeus remains in widespread use in the cyber-underground, security researchers have said.

The latest attack came from domains registered in Russia, and came in two waves. After dropping off last night, it spiked at around 34 percent of all spam at 15:00 hours UT today. According to Cisco Senior Security Researcher Henry Stern, the spam run appears to be done, and whatever botnet was involved has probably moved on to something new.

In addition to Zeus, a keylogger was installed to track keystrokes on an infected system and send information to cyber-criminals. When users log on to the legitimate EFTPS Website, the information transmitted to the attackers via the keylogger can range from bank account numbers to the name, phone number and address of a business.

"The timing of the attack seems to correspond with business tax filing season," Levy added. "This makes it particularly targeted at small and medium businesses."