Storm Worm Hitting Inboxs Worldwide

January 2007: A trojan dubbed "Storm Worm" has been spreading rapidly and infecting computers around the globe. The trojan is distributed in the form of an email attachment. The emails arrive with a variety of news-related subject lines designed to entice the recipient into opening the malicious attachment. A newer variant has email subject lines related to love and relationships.



The emails promise that the recipient can learn more about the issue mentioned in the enticing subject line by opening the attachment.

If opened, however, software is inadvertently installed that can give hackers full access to the compromised computer. The computer may then become part of a larger "botnet", a collection of many infected computers that can be controlled remotely and used to send spam messages, or conduct other malicious activities.

One of the most dangerous of the subject lines is one that promises information about a major storm that wreaked havoc in Europe. Emails with this subject line have been particularly effective because they were distributed around the same time that a real storm was raging across Europe.

The emails have a very large variety of subject lines. A small selection of the subject lines used in the infected emails is reproduced below:

* 230 dead as storm batters Europe.
* British Muslims Genocide
* Naked teens attack home director.
* A killer at 11, he's free at 21 and kill again!
* U.S . Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel
* Russian missle shot down Chinese satellite
* Russian missle shot down USA aircraft
* Sadam Hussein alive!
* A Bouguet of Love
* A Day in Bed Coupon
* A Monkey Rose for You
* A Red Hot Kiss
* Baby, I'll Be There

Storm Worm has been identified as one of the largest trojan attacks in years, so Internet users need to be especially cautious. Watch out for any unsolicited email that promises that you can get more information about a given subject by opening an attachment. Ensure that your anti-virus software is operational and up-to-date.






References:
F-Secure Weblog
'Storm Worm' rages across the globe
Storm-Worm Small.DAM Spread Quickly
Another trojan run by the Storm Worm gang
Hurricanelike storm leaves ruin, 47 dead across Europe

Last updated: 23rd January 2006
First published: 23rd January 2006

Write-up by Brett M.Christensen