« April 2010 · October 2010 »

June 2010
MonTueWedThuFriSatSun
 010203040506
07080910111213
14151617181920
21222324252627
282930    
July 2010
MonTueWedThuFriSatSun
   01020304
05060708091011
12131415161718
19202122232425
262728293031 
August 2010
MonTueWedThuFriSatSun
      01
02030405060708
09101112131415
16171819202122
23242526272829
3031     

Calendar:

  • 15.08.2010: Spam using RU domains - Who's your nameserver?
  • 13.08.2010: Binary Whitelisting Service
  • 02.08.2010: Of Opinions and Anti-Virus Testing
  • 05.07.2010: Lies, Damn Lies, and Botnet Size
  • 09.06.2010: Shadowserver Sinkholing domain associated with SQLi attacks on IIS/ASP web servers
Newest first Oldest first

Monday, 7 January 2008

Storm Worm and Stock Spam


A few days ago we posted about some of the recent holiday Storm Worm activity. We recently noticed Storm Worm web server nodes have started offering up GIF image files that appear to be aimed at pumping up the value of a penny stock. According to Spamtrackers.eu this particular stock scam was spammed out on January 4, 2007. This pretty much in line with what we'd expect from the text in the image.

Right now requesting any file ending in .gif from a Storm Worm web server will return this image which reads as follows:

Big Picks For 2008 Take Off!
Simulated Environment Concepts, Inc. (FAVE)
$0.005
We picked CHVC and CNOA last month before they took off, climbing as high as 400%. We feel FAVE is the next "Day Traders Dream". Volume is already jumping on the first day back from the holiday and now it will start to climb. Check out their website. This thing is gonna take off. Be ready to move first thing Thursday Morning!

Actual image:

Storm Worm Spam

It seems this was actually sent out last week, although it doesn't seem like it made very big waves. The value of the stock did not really change much and it doesn't seem to have made its way to too many people. Perhaps this was just a targeted or real short lived Spam run? Feel free to drop us a line if you have any additional details you would like to share.

Note: This post was updated to reflect changes discovered related to an possible Spam run of this stock on the January 4.

=>Posted January 07, 2008, at 09:04 PM by Steven Adair