« October 2007 · April 2008 · March 2010 »

December 2007
MonTueWedThuFriSatSun
     0102
03040506070809
10111213141516
17181920212223
24252627282930
31      
January 2008
MonTueWedThuFriSatSun
 010203040506
07080910111213
14151617181920
21222324252627
28293031   
February 2008
MonTueWedThuFriSatSun
    010203
04050607080910
11121314151617
18192021222324
2526272829  

Calendar:

  • 29.02.2008: ISO4 Conference - Sunnyvale California, United States
  • 20.02.2008: NSP-SEC Summit - San Jose California, United States
  • 18.02.2008: Gambling Websites Under Attack
  • 10.02.2008: Storm Worm Valentine's Day Update
  • 09.02.2008: Inbot08 Conference - Aachen, Germany
  • 30.01.2008: Citigroup BITS - New York, United States
  • 28.01.2008: Storm Worm & Stock Spam - The Never Ending Bag of Tricks
  • 09.01.2008: Storm Worm Domains Offline
  • 08.01.2008: Storm goes phishing?
  • 07.01.2008: See below.
  • 06.01.2008: RBN as RBusiness Network AS40898 - Clarifying the guesswork of Criminal Activity
  • 02.01.2008: Happy New Year to All!
  • 19.12.2007: MSISAC National Webcast - Albany New York, United States
Newest first Oldest first

Monday, 7 January 2008

Storm Worm and Stock Spam


A few days ago we posted about some of the recent holiday Storm Worm activity. We recently noticed Storm Worm web server nodes have started offering up GIF image files that appear to be aimed at pumping up the value of a penny stock. According to Spamtrackers.eu this particular stock scam was spammed out on January 4, 2007. This pretty much in line with what we'd expect from the text in the image.

Right now requesting any file ending in .gif from a Storm Worm web server will return this image which reads as follows:

Big Picks For 2008 Take Off!
Simulated Environment Concepts, Inc. (FAVE)
$0.005
We picked CHVC and CNOA last month before they took off, climbing as high as 400%. We feel FAVE is the next "Day Traders Dream". Volume is already jumping on the first day back from the holiday and now it will start to climb. Check out their website. This thing is gonna take off. Be ready to move first thing Thursday Morning!

Actual image:

Storm Worm Spam

It seems this was actually sent out last week, although it doesn't seem like it made very big waves. The value of the stock did not really change much and it doesn't seem to have made its way to too many people. Perhaps this was just a targeted or real short lived Spam run? Feel free to drop us a line if you have any additional details you would like to share.

Note: This post was updated to reflect changes discovered related to an possible Spam run of this stock on the January 4.

=>Posted January 07, 2008, at 09:04 PM by Steven Adair