Spamvertised LinkedIn notifications serving client-side exploits and malware

Spamvertised LinkedIn notifications serving client-side exploits and malware

by | Mar 23, 2012 | Industry Intel, Threat Lab

Reading Time: ~ 2 min.

Cybercriminals are currently spamvertising LinkedIn themed messages, in an attempt to trick end and corporate users into clicking on the malicious links embedded in the emails.

The campaign is using real names of LinkedIn users in an attempt to increase the authenticity of the spamvertised campaign.

More details:

Upon clicking on the malicious link, users are presented with a “Please wait page is loading…” page, whereas the malicious URL will try to exploit the “Help Center URL Validation Vulnerability” also known as CVE-2010-1885.

Sample client-side exploitation structure is as follows:

hxxp://therapower.com/jmwaWRj9/index.html
hxxp://174.133.92.122/MgGsg1Pp/js.js
hxxp://176.28.18.135:8080/showthread.php?t=73a07bcb51f4be71
hxxp://176.28.18.135:8080/content/Qai.jar
hxxp://176.28.18.135:8080/content/ap2.php?f=14095

The campaign is ultimately dropping the following malware sample: MD5: 517a86d7fe88aa53658fab1be7b7ef36. The same IP, 176.28.18.135 was also observed as a command and control served used by the following MD5: 02ce2bb3c0d58c9360bb185d6b200e03.

The cybercriminals behind the campaign are currently relying on thousands of compromised legitimate sites, in an attempt to trick web reputation filters into thinking that the payload is not malicious. Combined with the ever-decreasing price for launching a spam campaign through a botnet, the cybercriminals behind the campaign will definitely break-even from their original investment, and achieve a positive ROI (return on investment).

Webroot’s security researchers will continue monitoring the campaign, to ensure that Webroot SecureAnywhere customers are protected from this threat. Meanwhile, end and corporate users are advised to avoid interacting with the emails, to access the LinkedIn.com directly, and to ensure that they’re not running outdated versions of their third-party applications and browser plugins.

You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on  Twitter.

Blog Staff

About the Author

Blog Staff

The Webroot blog offers expert insights and analysis into the latest cybersecurity trends. Whether you’re a home or business user, we’re dedicated to giving you the awareness and knowledge needed to stay ahead of today’s cyber threats.

4 Comments

  1. eddievanholland
    eddievanholland on March 25, 2012 at 12:43 pm

    Although my main subject is home security I was looking to expand my blog with internet security.
    found some interesting posts on you blog.
    Can I quot you with a link back to you article?
    Thanks
    Eddie
    http://lblhomedefenseproducts.com/

    • Lisa Bongiovanni
      Lisa Bongiovanni on March 26, 2012 at 8:19 am

      Hi Eddie – Thanks for checking out our blog! That would be just fine. Feel free to use any of the content you find on our blog with a link back to the post you found it on.

  2. Nic Coventry
    Nic Coventry on March 28, 2012 at 6:26 am

    I’ve been using LinkedIn for quite some time, and I’ve only recieved a couple messages that seemed to me to be spam, and honestly, they weren’t that bad. This is really bad what you’re talking about here. I really glad I know about this now so that I can make sure to keep an eye out for these exploits. Thanks so much for this info.

  3. Risk Detective
    Risk Detective on May 23, 2012 at 10:27 am

    I agree with Nic, I have not seen a lot of spam coming through linkIn, but the stuff you’ve identified here is pretty clever and could be pretty damaging. Thanks for the info.

Trackbacks/Pingbacks

  1. Spamvertised Verizon-themed ‘Your Bill Is Now Available’ emails lead to ZeuS crimeware « Webroot Threat Blog - [...] Now where have we seen this IP before? In last week’s “Spamvertised LinkedIn notifications serving client-side exploits and malware”…
  2. Spamvertised ‘US Airways’ themed emails serving client-side exploits and malware « Webroot Threat Blog - [...] Based on the campaign’s structure, it’s launched by the same gang of cybercriminals that recently launched the following campaigns…
  3. A peek inside a managed spam service « Webroot Threat Blog - [...] customer could easily request the design of spam templates impersonating Google, Facebook, USPS, LinkedIn, U.S Airways, or Verizon [...]
  4. Ongoing ‘LinkedIn Invitation’ themed campaign serving client-side exploits and malware « Webroot Threat Blog - [...] the ‘LinkedIn Invitations’ themed malware campaign which I profiled in March, [...]
  5. Spamvertised ‘Your Amazon.com order confirmation’ emails serving client-side exploits and malware « Webroot Threat Blog - [...] Spamvertised LinkedIn notifications serving client-side exploits and malware [...]
  6. Ongoing spam campaign impersonates LinkedIn, serves exploits and malware « Webroot Threat Blog - [...] the LinkedIn exploits and malware serving campaigns which I profiled in March, and [...]
  7. Spamvertised ‘US Airways reservation confirmation’ themed emails serve exploits and malware « Webroot Threat Blog - [...] Verizon-themed ‘Your Bill Is Now Available’ emails lead to ZeuS crimeware” ; “Spamvertised LinkedIn notifications serving client-side exploits and…
Share This