Hackers prepare Valentine's Day botnet campaign

Security vendors, including MX Logic, Trend Micro and Panda Security, have begun warning about new Valentine's Day-themed spam campaigns that try to dupe users into installing the Waledec bot.

Share

Security vendors, including MX Logic, Trend Micro and Panda Security, have begun warning about new Valentine's Day-themed spam campaigns that try to dupe users into installing the Waledec bot.

Subject lines for the spam, said Sam Masiello , vice president of information security at MX Logic, are "short and sweet," and include "Me and You," "In Your Arms" and "With all my love."

Both Masiello and Florabel Baetiong, an anti-spam research engineer with Trend, noted the similarity between the recent infection attempt and Valentine's Day scams launched last year by hackers controlling Storm, a bot Trojan that has since fallen into disuse..

"Clearly the old Storm folks are working as hard as they can to build up their new botnet, and are following the old tried-and-true methods of centering their social engineering tactics around holiday themes," said Masiello in a post to the MX Logic blog .

"But it still impresses me that tactics like this continue to work and be so effective, despite how many times it gets recycled," Masiello said in an interview today.

Storm used Valentine's Day spam in both 2007 and 2008 to hijack PCs.

Waledec first began infecting systems just before Christmas , when it used phony holiday greetings and e-cards as bait, another Storm tactic during 2008. Last week, it surfaced again, this time hitchhiking on a spam run that claimed then President-elect Barack Obama would not take the oath of office on 20 January.

Although the Waledec botnet remains relatively small -- Stewart put it at just 10,000 machines -- it's growing at "an alarming rate," according to MessageLabs. In a report on botnets the e-mail security company released Monday (download PDF) , MessageLabs speculated that the botnet owners are "focusing on growing and developing this new botnet, rather than sending spam through it at this stage."

Several botnets that were heavily disrupted when McColo, a California-based hosting company, was taken off line, are in the same condition, Masiello added.

After suffering losses when McColo -- which had hosted command-and-control servers for several botnets, including one dubbed "Srizbi" and other called "Rustock" -- was yanked off the Internet, they have spent the last several months adding new PCs to their collection.

"Recommended For You"

Shutdown of hoster disarms 500,000 bots Spam blitz aims to reignite Storm trojan