The troublesome Storm botnet has switched from using the promise of Christmas strippers to bombarding people with messages touting the new year in a bid to dupe them into infecting their own PCs, according to security researchers.
UK-based Prevx and Symantec said the botnet of Storm Trojan-compromised computers is now sending spam with subject headings such as 'Happy 2008!' and 'Happy New Year!'. The messages try to persuade recipients to steer for the Uhavepostcard.com website to download and install a file tagged 'happy2008.exe,' said researchers at both firms.
However, the file is actually a new variant of the Storm Trojan.
Marco Giuliani of Prevx reported that the company had seen two general variants by early Wednesday. "The first has been online for about 10 hours, and we've seen 166 different repacked versions of it," said Giuliani in a posting to the Prevx company blog. The Storm code has been repacked every few minutes using a polymorphic-like technique since last Monday, when the botnet started spreading stripper spam. Frequent repacking is a trick malware authors use to deceive signature-based antivirus software.
The Storm botnet's herders are also using fast-flux DNS (Domain Name System) tactics to keep the Uhavepostcard.com site operational, said Symantec. Fast flux, which the Storm botnet did not originate but has often used, is another anti-security strategy; it involves rapidly registering and de-registering addresses as part of the address list for either a single DNS server or an entire DNS zone. In both cases, the strategy masks the IP address of the malware site by hiding it behind an ever-changing array of compromised machines acting as proxies.
The notorious Russian Business Network malware hosting network has become infamous for using fast flux to hide the Internet location of its servers, making it difficult for security researchers, Internet service providers or law enforcement officials to track the group's cybercrimes.