Swine Flu Spam Attempt to Infect Japanese Users(情報元のブックマーク数)

ぉーーー!「by Japan Regional TrendLabs 」が英語Blogの記事を書いています!素晴らしい。

Another swine flu-related spam run was recently reported, this time targeting Japanese users. Aside from using the swine flu as its social engineering method, which has already been used in earlier spam runs, this spam run also uses a technique where the sender of the message appears to use the .yahoo.co.jp domain. This serves not only as a means to evade spam filters, but also to further fool the users that the message is legitimate, thus convincing them to open an attached malicious file.

Spammed messages with the subject Warning of Swine Flu claiming to be from the National Institute of Infectious Diseases, encourages users to open an attached .ZIP file, to “learn” more about the pandemic (detection available as TROJ_PIDIEF.UA and TROJ_PIDIEF.TY). Our engineers have verified that TROJ_PIDIEF.TY drops and executes BKDR_KUPS.G.

Swine Flu Spam Attempt to Infect Japanese Users - TrendLabs Security Intelligence Blog

1344のドメインが取られているのですか!!!!すげぇ。

There are 1,344 on the list. Again, so far, none of the domains we've checked are hosting any malicious files.
In fact, the only malicious file we've seen is something that Symantec posted about last week.
It's a PDF "Swine Flu FAQ" exploit which drops a password stealer and then opens a clean PDF file as a decoy.

News from the Lab Archive : January 2004 to September 2015

screenshot