By John Leyden for The
Register.
This story has been reproduced with permission.
Email security services firm MessageLabs has intercepted emails
that are both spam and links to download viruses. Cyber-criminals
have long used email viruses to create botnets to send spam, but
this is the first time MessageLabs has seen virus links hidden
within spam.
Since 14 April, MessageLabs has stopped thousands of spam stock
pump-and-dump emails which also contained links to websites hosting
malware. Purporting to be a screen saver, the malware then drops
the Zhelatin MeSpam engine onto compromised PCs.
Mark Sunner, chief security analyst at MessageLabs, commented:
"Why use two emails when just one will do? Now we are seeing the
bad guys layer on the threats – as if it's not enough to just scam
someone and fill their inbox with junk email, why not also infect
and take control of their computer at the same time."
"HTTP has replaced SMTP [email] as the path of least
resistance," he added.
Stealth
Large scale virus outbreaks have almost become a thing of the
past - hackers have increasingly sought to trick users into
visiting websites containing malicious code rather than open
infectious email attachments. This means that even as spam volumes
increase, the volume of malware contaminated email is dropping.
MessageLabs reckons 83.6 per cent of email traffic circulating
the internet in April was spam. Meanwhile, the global ratio of
viruses in email traffic - from new and previously unknown bad
sources destined for valid recipients - was one in 145.5 (0.69
percent), a decrease of 0.003 percent since March.
Email-based attacks are becoming more targeted. Last month
MessageLabs intercepted 716 emails in 249 separate targeted attacks
aimed at 216 different organisations. Of these, almost 200 were
one-on-one targeted attacks where the tailored attack comprised a
single email designed to infiltrate an organisation. Infected
PowerPoint files are becoming almost as common as infected Word
files. By comparison, only one or two such email attacks per day
were recorded in the same period last year.
© The Register
2007
