Spamvertised AICPA themed emails serve client-side exploits and malware
Certified Public Accountants (CPAs) are a common target for cybercriminals. Throughout 2012, we intercepted several campaigns directly targeting CPAs in an attempt to trick them into clicking on the malicious links found in the emails. Once they click on any of the links, they’re automatically exposed to the client-side exploits served by the latest version of the Black Hole Exploit Kit.
In this post, I’ll analyze one of the most recently spamvertised campaigns impersonating the American Institute of Certified Public Accountants, also known as AICPA.
More details:
Black Hole Exploit Kit author’s ‘vertical market integration’ fuels growth in malicious Web activity
Historical cybercrime performance activity of multiple gangs and individuals has shown us that, in order for them to secure multiple revenue streams, they have the tendency to multi-task on multiple fronts while operating and serving the needs of customers within different cybercrime-friendly market segments.
A logical question emerges in the context of the fact that 99% of all the spamvertised campaigns we’re currently intercepting rely on the latest version of the Black Hole Exploit Kit – is Paunch, the author of the kit, multi-tasking as well? What’s the overall impact of his ‘vertical market integration‘ practices across the Web beyond maintaining the largest market share of malicious activity in regard to Web malware exploitation kits?
Let’s find out by discussing two of his well known revenue sources and sample a campaign that’s relying on the managed iFrame/Javascript crypting/obfuscating service that he’s also operating.
More details:
Novel Approach to Malware Discovery in today’s Threat Landscape
There are a number of similarities between biological viruses and those which infect our PC’s. For one, both types of infections rely on mutations to evade detection and survive. The faster the mutations, the more difficult an infection is to combat. This is because those who spend their time and effort fighting such infections are likely to miss a mutation and therefor lack the chance to create a cure. This point is especially true with traditional antivirus technology where discovery and detection techniques have not kept up with the rapid pace of mutations common in today’s threat landscape. The recent NY Times article ‘Outmaneuvered at Their Own Game, Antivirus Makers Struggle to Adapt’ reported that, “On average, it took almost a month for antivirus products to update their detection mechanisms and spot the new viruses.”
Meet the Webroot Intelligence Network (WIN), a novel new approach to malware intelligence, discovery, detection and protection which scales with the pace of the malware industry. How did we do it? By first creating the most powerful threat intelligence engine the world has ever seen. A cloud hosted engine which correlates live data from millions of user endpoints, honeypots, and sensor networks from around the globe, all in real-time. This engine has populated the Webroot Intelligence Network with detailed data on millions of malicious programs, is aware of over 8.7 billion URL’s, 550 million IP addresses and 2 million mobile applications. WIN provides the necessary visibility into a rapidly mutating and evolving threat landscape to provide Webroot products the intelligence needed to keep users secure.
One key element to the success of WIN has been leveraging the power of our users. By turning every customer endpoint into a malware discovery node capable of sending newly discovered file data to WIN, Webroot researchers around the world are able to analyze and classify incoming data in real time. When a new malicious program, URL or IP is discovered, the entire user-base is immediately protected; no definition updates required. There are a number of benefits to this approach; one of the biggest being that malware variants don’t slip through the cracks. If a Webroot user is the first to see a new infection, it is only a matter of minutes before a researcher discovers the infection and creates a rule to detect and protect the entire user-base. Compare this to traditional signature based AV’s which must first collect the sample (if they can find it – in many cases samples are missed due to the intentionally short lifespan of today’s malware variants), analyze it, and finally release a new detection signature which lastly has to be sent to the endpoint. As the NY Times article mentions, “Part of the problem is that antivirus products are inherently reactive. Just as medical researchers have to study a virus before they can create a vaccine, antivirus makers must capture a computer virus, take it apart and identify its “signature” — unique signs in its code — before they can write a program that removes it. That process can take as little as a few hours or as long as several years.” Most often, by the time a new signature is released, the malware variant it is designed to detect is no longer relevant.
The strength of a security solution is directly related to the quality of its intelligence. By enabling our products to participate in the discovery of new infections, WIN ensures our researchers have the visibility needed to keep up with a malware landscape which relies heavily upon flooding the market with newly compiled infections designed specifically to evade traditional AV methodologies. In many ways, the AV industry is responsible for the current day problem. The lack of innovation and adaptation to the problem created an easy out for malware authors. Webroot aims to change this paradigm by including the force of its entire user-base to combat the problem. It has long been said that the AV industry is at a disadvantage because for every security researcher fighting these infections, there were certainly 100 if not 1,000 hackers creating such infections. Webroot has upped the ante by recruiting its millions of users to help in the fight to keep our personal data and online activities secure. Malware has nowhere to hide when up against the Webroot Intelligence Network.
A peek inside a boutique cybercrime-friendly E-shop – part six
In 2012, we started the “A Peek Inside a Boutique Cybercrime-Friendly E-shop” series, in response to the emerging market segment largely driven by novice cybercriminals relying on ubiquitous E-shop templates to sell their fraudulently obtained assets.
In this post, I’ll profile one of the most diversified (in terms of quantity and type of fraudulently obtained assets) boutique cybercrime-friendly E-shops I’ve come across since the launch of the series.
More details:
Fake ‘You have made an Ebay purchase’ themed emails lead to client-side exploits and malware
‘Attention! Changes in the bank reports!’ themed emails lead to Black Hole Exploit Kit
Cybercriminals are currently spamvertising tens of thousands of emails in an attempt to impersonate the recipients’ bank, tricking them into thinking that the Ministry of Finance in their country has introduced new rules for records keeping, and that they need to print and sign a non-existent document.
Once users click on the links found in the malicious emails, they’re automatically exposed to the client-side exploits served by the latest version of the Black Hole Exploit Kit.
More details:
Fake BBB (Better Business Bureau) Notifications lead to Black Hole Exploit Kit
Cybercriminals have recently launched yet another massive spam campaign, impersonating a rather popular brand used in a decent percentage of social engineering driven email campaigns – the BBB (Better Business Bureau).
Once users click on any of the links in the malicious emails, they’re automatically exposed to the client-side exploits served by the Black Hole Exploit kit.
More details:
Spamvertised ‘Your Recent eBill from Verizon Wireless’ themed emails serve client-side exploits and malware
Throughout 2012, we intercepted two malicious campaigns impersonating Verizon Wireless in an attempt to trick its customers into clicking on links pointing to fake eBills.
It appears that cybercriminals are back in the game, with yet another Verizon Wireless themed malicious campaign, enticing users to click on the malicious link found in the email. Once users click on the link, they’re automatically exposed to the client-side exploits served by the latest version of the Black Hole Exploit Kit.
More details:
Webroot’s Threat Blog Most Popular Posts for 2012
It’s that time of the year! The moment when we look back, and reflect on Webroot’s Threat Blog most popular content for 2012.
Which are this year’s most popular posts? What distinguished them from the rest of the analyses published on a daily basis, throughout the entire year?
Let’s find out.
Fake ‘UPS Delivery Confirmation Failed’ themed emails lead to Black Hole Exploit Kit
Continuing their well proven social engineering tactic of impersonating the market leading courier services, cybercriminals are currently mass mailing tens of thousands of emails impersonating UPS, in an attempt to trick users into clicking on the malicious links found in the legitimate-looking emails.
Once they click on the links, they’re automatically exposed to the client-side exploits served by the Black Hole Exploit kit.
More details:
Cybercriminals resume spamvertising British Airways themed E-ticket receipts, serve malware
British Airways customers, watch out!
Cybercriminals have resumed spamvertising fake British Airways themed E-receipts — we intercepted the same campaign back in October — in an attempt to trick its customers into executing the malicious attachment found in the emails.
More details:
Pharmaceutical scammers spamvertise YouTube themed emails, entice users into purchasing counterfeit drugs
Pharmaceutical scammers are currently spamvertising a YouTube themed email campaign, attempting to socially engineer users into clicking on the links found in the legitimately looking emails.
Upon clicking on the fake YouTube personal message notification, users are redirected to a website reselling popular counterfeit drugs. The cybercriminals behind the campaign then earn revenue through an affiliate network.
More details: