The minds behind the Waledac botnet are using the physical location of victims’ machines in a scheme to lure them with false news reports.
The e-mails, which have subject lines like “Why did it happen in your city?” claim that 18 people have been killed in an explosion and link to what appears to be a Reuters-related news site. Those who click on the link, however, end up on a malicious site that attempts to trick people into clicking on a video that appears to be breaking news about a terrorist attack.
In an interesting twist, the Web site does a GEO-IP lookup on the victim’s whereabouts and customizes the story to appear as though it relates to the victim’s location.
“We have seen spam-or, more accurately, the Web sites that spam leads you to-doing geo-location before, but I can’t at the moment think of previous occasions when it’s been used as part of the trap to infect you with malware,” said Graham Cluley, senior technology consultant at Sophos.
The worm harvests e-mail addresses from Windows PCs and spams itself on to other users, Cluley explained. In addition, it converts compromised computers into bots that can be used remotely by hackers. There are opportunities through this for identity theft, further spamming and other crimes such as distributed denial-of-service attacks as well, he added.
Waledac appeared on the malware scene late last year with a blended threat Christmas e-card campaign. The botnet is believed by many security researchers to be a reincarnation of the infamous Storm botnet that wreaked havoc in 2007 and played a major role in the Valentine’s Day spam attacks last month.
“[This is] further evidence, as if any were needed, that the botnet creators are still actively filling the void left behind by various events last year, such as the dismantling of the Storm botnet and the takedown of McColo,” blogged Trend Micro Solutions Architect Rik Ferguson.