Users at risk from 4th July trojan

Storm spam trojan returns as Independence day electronic greeting card.

Users have been warned that emails containing a link to download an electronic Independence Day-themed greeting card are in fact spam that instead downloads malware.

The Storm trojan has been active since January this year and in its current guise it comes via an email inviting recipients to click on a link to receive an Independence day greeting from a friend. The link leads to a compromised computer hosting the JSecard-A trojan. The malware then attempts to download the Mal/Dorf-C malware.

Among the subject lines used in the spam emails include, "America the Beautiful", "Independence Day Celebration" and "July 4th Fireworks Show".

Should the malware successfully download and install, the victim's computer then becomes part of a botnet. The Storm trojan has appeared in a variety of guises over the last few months, usually piggybacking on current events in a bid to entice users into downloading the malware.

"Today's run of the Storm trojan using the fourth of July as its hook continues this theme of exploiting current events to entice unsuspecting email users into infecting themselves," said Bradley Anstis, director of Product Management at email security company Marshal.

Graham Cluley, senior technology consultant at anti-virus company Sophos said that the fact that the web link contains an IP address instead of a web address should said ring alarm bells for users.

"Rather than being sent to a real ecard website when you click on the link, you are visiting someone else's compromised computer which is hosting malicious code designed to infect your Windows PC," said Cluley. "It is these same computers, based all around the world, which are spewing out spam."

Virus researchers said that these types of viruses are becoming more popular with hackers and it wasn't a surprise that criminals used the US national holiday to fool users into downloading malware.

Patrik Runald, technical manager at F-Secure said that hackers are working hard to avoid detection.

"What's great is that the security community is actively trying to get these sites shut down but the bad guys just keep on changing the IP address in the new mails," he said. "In addition, they keep changing the files that are being downloaded."

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021