- Oct 23, 2012
- 12,527
Two massive spam campaigns that delivered over 210,000 emails flooded the inboxes of Italian users with files that carried the Andromeda malware.
The spam campaign took place on July 4-5 and on July 11-14, and according to the security researchers from Palo Alto Networks, the crooks intentionally targeted Italian users.
In fact, based on clues in the emails, 97.4 percent of all the spammed content was aimed at Italian users.
The clues include the spam email subject lines (which were all in Italian), the file attachment's name (also in Italian), and the email address used to send the spam (spoofed addresses belonging to Aruba.it, an Italian-based Web hosting provider, and other Italian domains).
All files attached to these emails were spreading Andromeda, a malware dropper that adds infected computers to the Andromeda botnet.
The malware's technical capabilities allow the people behind this botnet to deliver other types of malware to infected victims at the push of a button in a control panel.
This includes keyloggers, rootkits, infostealers, RATs, and any other Andromeda module they would wish, with any functionality.
The Andromeda malware and botnet appeared in 2011 and has been used to spread other types of malware families such as the GamaPoS malware.
The good news is that, according to a Check Point ranking released today, Andromeda is not that common, not being part of the top 10 most encountered malware families for June. We'll have to wait for July's report.
The spam campaign took place on July 4-5 and on July 11-14, and according to the security researchers from Palo Alto Networks, the crooks intentionally targeted Italian users.
In fact, based on clues in the emails, 97.4 percent of all the spammed content was aimed at Italian users.
The clues include the spam email subject lines (which were all in Italian), the file attachment's name (also in Italian), and the email address used to send the spam (spoofed addresses belonging to Aruba.it, an Italian-based Web hosting provider, and other Italian domains).
All files attached to these emails were spreading Andromeda, a malware dropper that adds infected computers to the Andromeda botnet.
The malware's technical capabilities allow the people behind this botnet to deliver other types of malware to infected victims at the push of a button in a control panel.
This includes keyloggers, rootkits, infostealers, RATs, and any other Andromeda module they would wish, with any functionality.
The Andromeda malware and botnet appeared in 2011 and has been used to spread other types of malware families such as the GamaPoS malware.
The good news is that, according to a Check Point ranking released today, Andromeda is not that common, not being part of the top 10 most encountered malware families for June. We'll have to wait for July's report.
