Brace for email-attachment malware spree
A sizeable spike in malicious email attachments is just subsiding, but if history is any indicator, several smaller spikes are about to follow that use even more deceptive means than their predecessors.
The recent surge, fueled in large part by a flood of phony messages from UPS, is similar to one observed at the end of March in that the messages urge recipients to open an attachment that releases the malware on victims' machines, according to Internet security firm Commtouch.
The earlier wave used a wider variety of package-delivery services as senders, including FedEx and DHL, but the latest outbreak employs a wider variety of messages such as, "Dear client, recipient's address is wrong", "Dear User, Delivery Confirmation: FAILED", and "Dear Client, We are not able to delivery [sic] the postal package", according to the Commtouch blog.
All the messages then instruct the recipient to open the attachment that contains the malware, claiming it is an invoice or a form that needs to be filled out. "This time we see differences in the style of the emails - there is far more variation in the automatically-generated subjects, body and attachment names. Last time all the attachments were "UPS.exe" - this time there are many variations," says Avi Turiel, director of product marketing at Commtouch in an email.
The attackers will evaluate the success of the attack by finding out how many recipients activated the malware, "Based on the infections vs. malware sent out they will probably try and figure out what they could improve in the next attack," he says.
The most recent spike saw malicious-attachment email jump from 814 million on Aug. 6 to 15.2 billion on Aug. 12, Turiel says. He says that after the March assault, his company observed a rollercoaster pattern of several, gradually decreasing spikes. "The fading effect is basically a reflection of global email systems learning to reject the emails. The malware writers will perceive this since they will gradually see fewer infections," he says.
(Source: computerworld.com)
