Malware in mail adminstrators grab

Phishers have begun employing spam using the system or mail administrator’s name to wreak havoc on companies’ computers and servers.

If you receive a mail from your system or mail administrator asking you to upgrade your system software due to a recent server upgrade, be careful. Phishers have started employing spams using the system administrator’s name to target employees in IT and banking sectors who largely work on computers.

When a server is upgraded, clients need to be updated or upgraded. Using this modus operandi, phishers have started sending spams in the name of system or mail administrators of the same company or organisation. Computer Emergency Response Team, India (CERT.in) has recently posted an alert that a new wave of spam emails, purportedly arriving from the organisation’s system/mail administrators /tech-support team, is being widely circulated.

These ‘highly personalised’ spam mails alert users to update/upgrade system software due to a recent server upgrade and includes an URL or ZIP attachment. It urges the users to click on the URL or open the attached ZIP file, and execute for updation. Some of the attached/downloaded malware are detected as ZBot /Cutwail variants.

This email message spoofs the sender email address so the sender looks like ‘tech-admin /support @organisation-domain -name’ and links are having this format: http:££updates.organisation-domain.secure.some-domain mail£id=-legitimateemail@ organisation-domain.com -patch407574.exe

To make it more convincing, the victim’s domain name is used as sub-domain and used throughout the message body along with the victim’s e-mail address.

A cyber crime expert said, “This is a new modus operandi which criminals have employed. This is just to break the company’s firewall by duping an employee. If one clicks on the attachment, he would be compromising not only his but also the company’s network.”

Source:

Bangalore Mirror Dtd. 22/10/2009

Article By Sameer Ranjan Bakshi