BELARUS NEWS AND ANALYSIS
DATE:
05/01/2011
US govt e-card scam hits confidential data
By Tyler Thia, ZDNet Asia
A fake U.S. government Christmas e-card has managed to siphon off gigabytes of sensitive data from a number of law enforcement and military staff who work on cybersecurity matters, many of whom are involved in computer crime investigations.
According to news.softpedia.com, the rogue e-mail messages sent out on Dec. 23 last year had the subject "Merry Christmas" and purported to originate from a jeff.jones@whitehouse.gov address.
The body message read: "As you and your families gather to celebrate the holidays, we wanted to take a moment to send you our greetings.
"Be sure that we're profoundly grateful for your dedication to duty and wish you inspiration and success in fulfillment of our core mission."
This was followed by two links to the alleged greeting cards, which lead to pages hosted on compromised legit Web sites. Victims who clicked on the links were infected with a Zeus Trojan variant, which stole passwords and documents, and uploaded them onto a server in Belarus, reported krebsonsecurity.com.
The article also revealed that the latest attack bore the same technique to one uncovered last year, where 74,000 PCs were found to be part of a botnet. In the earlier incident, victim machines were controlled by Web sites registered with the same e-mail address. Alex Cox, principal research analyst with NetWitness, said the new case either involved the same person or copied the exact same technique.
Security blogger Mila Parkour pointed out that the "pack.exe" file downloaded by the Trojan was a Perl script converted to an executable file by way of a commercial application called Perl2exe. The pack program was responsible for stealing the documents on a victim's computer and relaying the data to a file repository in Belarus.
Krebsonsecurity.com author Brian Kerb said: "The attack appears to be the latest salvo from Zeus malware gangs whose activities over the past year have blurred the boundaries between online financial crime and espionage, by stealing both financial data and documents from victim machines."
He explained that this activity was unusual as most criminals using Zeus were interested in money-related activities, whereas the siphoning of government data was associated with advanced persistent threat attacks, the same category that of stuxnet attacks.
Some of the victims included an employee at the National Science Foundation's Office of Cyber Infrastructure, an intelligence analyst in Massachusetts State Police and an employee at the Financial Action Task Force.
Another report by news agency AP said there was no evidence that the stolen classified information had been compromised.
Source:
http://www.zdnetasia.com/us-govt-e-card-scam-hits-confidential-data-62205450.htm
Archive
Subscribe Daily Newsletter:
