08:27 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly

Red Condor Detects Sophisticated One-Two Punch Malware Campaign

Scammers using spoofed brands, social engineering, and phishing tactics to distribute malware on PCs via drive-by download

Rohnert Park, Calif. – June 9, 2010 – Red Condor today issued a warning of a new sophisticated email malware threat that spoofs YouTube and uses a redirect on a compromised website to a common Canadian Pharmacy web site to distribute malicious PDFs via drive-by download. The pharmacy page is actually a red herring that has distracted many security researchers from the true motive of these campaigns, a stealth drive-by download. With a single click, users can infect their computers.

The malware, which as of the morning of June 9, 2010 had not been detected by any anti-virus engines, comes in the form of a malicious PDF download. Red Condor has captured 10 versions of the malicious PDF, which likely exploits vulnerabilities in Adobe Acrobat. The campaign appears to be part of a much larger attack first detected by Red Condor several weeks ago (see Red Condor blog entry April 23, 2010) and has also recently spoofed Facebook and Twitter, among other popular brands. As unsuspecting users wait for what they believe is a YouTube or Twitter friend request, a greeting card, or even a Facebook login page to load, their browsers download and execute the malicious code, and then the Canadian Pharmacy page appears.

“The amount of effort behind these new campaigns is not commensurate with the typical Canadian Pharmacy spam campaigns that we have seen in the past. It’s the primary reason we started to suspect weeks ago that these campaigns have an ulterior motive and are more than just a series of mundane Canadian Pharmacy spam,” said Dr. Thomas Steding, CEO of Red Condor. “After analyzing this threat over the past several weeks, we now believe that this malicious drive-by downloading may be a new trend; a double-purposing spam campaign, or a twist on the blended threat spectrum of attacks we have seen so prevalent in the past year. Spammers are starting to use social engineering hooks, including those common with phishing attacks, which will generate clicks. If users click on the spam link, there is an opportunity for a sale and to steal their identities while infecting their computers – a sophisticated one-two punch.”

An interesting feature of this malware campaign is the distribution points appear to actively take measures to make researching the exploits difficult. The malware is served only if it thinks it can infect, and even then only upon the first request. Subsequent, identical requests from the same IP address do not result in the malware download. This level of intelligence and effort prevents traditional email security solutions, which rely on only automated detection methods from stopping the threat. Red Condor’s email security experts monitor for and analyze new threats twenty-four hours a day, seven days a week.

Key attributes of this new campaign include:

1. The URL uses a compromised middleman redirect that includes a slight delay before the redirect (http-refresh) occurs. The redirection page includes an iframe injection from a known malware distribution point. When users click on the link in the spam message, a blank page opens up in their browser and five seconds later a Canadian Pharmacy site pops up. While the user was waiting for what they think is a YouTube friend request to appear, a malicious JavaScript is fetched from the remote server referenced in the iframe resource. 2. The malware distribution point mentioned changes behavior depending on the details of the browser request. For example, it appears to be sensitive to User-Agent, as well as Accept HTTP Get request header items, which specify to the HTTP server what kind of device is making the request and what its capabilities are. 3. Only one request is allowed per IP. After the initial request, subsequent requests issue a null response (0 data returned). 4. There is likely a timing component as well that triggers the malware download.

Screen captures and images of campaign available upon request.

About Red Condor

Red Condor is revolutionizing spam fighting with its next-generation technology. Red Condor’s highly accurate email filter, hybrid architecture Vx Technology™, and fully managed appliances lead to a dramatic reduction in the cost of owning a premium spam filter. With solutions for small businesses, as well as ISPs with millions of email inboxes, Red Condor has a cost-effective, timesaving solution that is rapidly gaining market share. The system’s design has built-in zero tolerance for lost email, and a near zero false positive rate while achieving long-term spam block rates greater than 99%. Red Condor Archive is a secure message archiving service with lifetime retention and unlimited storage. The company’s next-generation technology is backed by a 24x7 customer care center staffed by email security experts at Red Condor’s headquarters. For more information, visit www.redcondor.com.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.