Anti-Georgia spammers building new botnet

Anti-Georgia spammers are trying to set up a malicious network of botnet computers.

Hackers targeting Georgia in the midst of its conflict with Russia have started sending out a new batch of malicious spam messages, apparently with the aim of building a new botnet network of remote-controlled computers.

The poorly worded messages started going out early Friday morning, and now make up close to five percent of the spam traffic measured by the University of Alabama at Birmingham's Spam Data Mine, according to Gary Warner, a director of computer research and forensics at the university. That's about a third of the volume of the CNN- and MSNBC-related spam that has been flooding inboxes this week, but it's still significant, he said.

With headlines like "Mikheil Saakashvili gay scandal! New of this week!" the stories try to trick victims into clicking on a fake BBC story about the president of Georgia. When the victim clicks on the link, however, he is taken to a malicious Web server that then tries to infect his computer.

Disturbingly, the attack code used by this Web server is not blocked by most antivirus products, Warner said. In tests, his team found that only four out of the 36 antivirus products featured in the Virus Total malware testing service spotted the code.

So far, Warner's team has tracked the messages back to 44 spam-sending computers, none of which has previously been associated with junk e-mail. Interestingly, six of these computers are located in Russia, which is rarely a direct source of spam, and one of them lies within the Russian Ministry of Education.

Although the spammers seem to be setting up a botnet, the ultimate use of this network remains unclear. Warner speculated that it could be used to launch further cyber-attacks against Georgian government computers.

Symantec has identified the malicious software as a variant of the Trojan.Blusod program, said Kevin Haley, director of product management with Symantec Security Response. In the past, spammers have used this program to install fake antivirus software on victim's computers, which then falsely identifies problems and offers to clean them up for a fee, he said.

Warner disputed Symantec's analysis, noting that Symantec itself was not detecting the Trojan program, according to Virus Total. "This is new malware," he said.

The question of whether Georgia and Russia are engaging in state-sponsored cyber-warfare has been a matter of some debate, following the eruption of hostilities between the two countries on Aug. 7.

On Monday, Georgia moved its Ministry of Foreign Affairs Web site to Google's Blogspot, claiming that a Russian cyberattack had knocked its server offline.

Security experts say that while the recent Georgian cyber-attacks are more intense then those launched a year ago against Estonia, there is no evidence that either of the events were actually state-sponsored cyber-warfare.

Some have likened those events to a "cyber brawl," with nationalistic Russian hackers launching spontaneous computer attacks against neighboring Estonia.

"I think it's almost exactly what we saw back in Estonia," Warner said of the recent events in Georgia. "I really doubt this is any action by the Russian government."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?