From: Elizabeth Bookman (Corp Marke-UK)
Sent: Thursday, March 25, 2010 11:21:17 PM
To: Jon Clay (MKT-US); Newsbank
Subject: RE: Newsbank: Malware attack uses China World Expo guise
Auto forwarded by a Rule
Yes we do, but analysis of the components of this threat is still ongoing.
TROJ_PIDIEF.ACV (the attachment within the spammed message) and TrendLabs experts are analyzing the backdoor element as we speak.
Do we have the file mentioned below that Kaspersky catches but we don’t?
Sr. Core Technology Marketing Manager
With reference to the article (pasted below), please also see our blog - http://blog.trendmicro.com/shanghai-expo-spam-carries-backdoor/
Analysis of this threat is ongoing, but this story will likely garner HUGE attention.
I am in process of activating our alert banners on TM.com and we are putting together an advisory with further information.
Malware attack uses China World Expo guise
An e-mail with a malicious attachment was sent to at least three foreign journalists in China
By Owen Fletcher, IDG News Service
March 25, 2010 06:21 AM ET
A malware attack dressed up as an e-mail from organizers of the upcoming Shanghai World Expo targeted at least three foreign journalists in China, in the latest sign of increasingly sophisticated cyberattacks from the country.
The e-mail appeared to be sent from the inbox of the Expo news office, but it was not sent by the Expo and may be targeting journalists who signed up to cover the event, a reporters' advocacy group in China told members in an e-mail on Thursday.
Google drew global attention to cyberattacks from China two months ago, when the company said it had detected hacking attempts from the country partly aimed at the Gmail accounts of Chinese human rights activists. Google also said the attacks had caused the loss of Google intellectual property and that at least 20 other large companies were targeted. Chinese authorities use various methods to keep political dissidents under surveillance, but Google did not blame the Chinese government for the attacks.
There was also no evidence to suggest that the e-mail sent to foreign journalists had any tie to the government. But at least one version of the e-mail, which was sent by an attacker to IDG News Service, clearly targeted people who had filled out a spreadsheet to register for the Expo. The e-mail had a .pdf attachment that exploited a recently patched vulnerability in Adobe Reader, according to scan results on the Wepawet malware analysis Web site.
There seems to be a [definite] increase in sophisticated, targeted attacks coming out of China," said Paul Ferguson, a researcher at Trend Micro, in an instant message.
Eastern Europe is a base for many cybercriminals who aim to profit by illicitly obtaining credit-card and banking information from victims. But large-scale attacks from China are often aimed at stealing intelligence or intellectual property, Ferguson said.
The World Expo will be a months-long show in Shanghai this year where dozens of countries will set up displays. The government sees the event as a display of China's rising influence abroad.
The alert sent out by the reporters' group in China said .pdf attachments had become a common mode of attack and that antivirus tools often do not pick up the types of malware involved. On Thursday afternoon in China, Kaspersky was the only vendor out of 42 tested by VirusTotal that labeled the file in the fake Expo e-mail as malicious.
China has repeatedly said its laws ban cybercrime including hacking attacks when asked about accusations of government involvement in attacks.
The IDG News Service is a Network World affiliate.