TMCnet Feature Free eNews Subscription
June 23, 2011

Watch for Malicious Spam Pretending to be from Federal Reserve or IRS

By Ed Silverstein, TMCnet Contributor



A new large attack of spam – pretending to be from either the Federal Reserve or IRS – has surfaced and is carrying Zeus Trojan, according to security analysts.

It appears to be aimed at small and midsize organizations and wants them to click on malicious links.

Security pros at Barracuda Labs were believed to be the first team to see the large increase in “malicious messages” on Monday, according to a report from SC Magazine.

Thankfully, the emails were blocked before they could reach approximately 120,000 users in just 10 minutes, SC Magazine adds.

Security researchers from Barracuda Labs – David Michmerhuizen and Luis Chapetti – said that amount of spam is totaling “many hundreds of thousands a day.”

It was being sent to a cross-section of Internet users, Barracuda said.

Based on the content of the messages, the spam is related to online banking services and may be directed to officials in charge of an organization’s finances, according to media reports. Some of the spam suggests it’s from the Federal Reserve and pretends to be a notice reporting a failed wire transfer.

On Wednesday, the scheme was changed to use the name of the IRS. Recipients were told that federal tax payments had been canceled and they were instructed to click on a link for details, according to SC Magazine.

Barracuda also reported that Zeus Trojan is known for stealing passwords. Specifically, Zeus targets banking passwords, Barracuda said.

Last week, security pros reported on the Chase Paymentech spam campaign.

“Unlike the more sophisticated Chase emails, these are a simple affair with poorly constructed text and no attempt at hiding the executable nature of the linked payload,” Barracuda said. “Still, there’s the possibility that a busy executive might just skim the spam and click on the attachment, resulting in a Windows security warning.”

Users will then be asked to install the “executable” program that in reality is “the data-stealing Zeus Trojan, notorious for keylogging the corporate banking credentials belonging to small and midsize businesses, school districts and charities,” according to SC Magazine.

Barracuda Labs reminded users that the Federal Reserve will not send important information which has been coded into a program.

“Don’t run it,” cautioned Barracuda Labs. “If you do, you’ve installed Zeus. It will run quietly in the background, intercepting browser traffic, watching for credentials and sending any it finds off to its command and control server.”

In a related matter, TMCnet reported recently that with 6 million unique samples of recorded malware, the first quarter of 2011 was the most active first quarter in malware history, according to data from McAfee (News - Alert). Still, spam was at its lowest level since 2007, TMCnet added.

Want to learn more about the latest in communications and technology? Then be sure to attend ITEXPO West 2011, taking place Sept. 13-15, 2011, in Austin, Texas. ITEXPO (News - Alert) offers an educational program to help corporate decision makers select the right IP-based voice, video, fax and unified communications solutions to improve their operations. It's also where service providers learn how to profitably roll out the services their subscribers are clamoring for – and where resellers can learn about new growth opportunities. To register, click here.


Ed Silverstein is a TMCnet contributor. To read more of his articles, please visit his columnist page.

Edited by Jennifer Russell
» More TMCnet Feature Articles
Get stories like this delivered straight to your inbox. [Free eNews Subscription]
SHARE THIS ARTICLE

LATEST TMCNET ARTICLES

» More TMCnet Feature Articles