Malware Writers Riding European Storms

Even as severe storms were battering Europe, malware-bearing email claiming to offer details of the storms buffeted Internet users' mailboxes.

Even as storms were buffeting Europe, email messages bearing the Small.DAM Trojan horse begin pummeling email servers and inboxes around the world, claiming to carry details of the storm’s rampage. The email messages, many bearing the subject “”230 dead as storm batters Europe,” could leave unprotected computers vulnerable to attack or takeover by spammers. When opened, the attachment—which could arrive under a number of different names—installs a back door which can give the malware author complete access to the infected PC.

In a statement, Mikko Hypponen, Chief Research Officer at F-Secure said: “Trojan assaults of this scale are an unfortunate and increasingly common event. What is significant here though is the timely nature of this assault in relation to the European storm. Malware gangs are clearly using every technique and even tragedies like these to gain access to vulnerable machines.”

As with other malware attacks, the intention of the so-called “Storm Surge” in malware is probably to create or expand a network of zombie computers which can be used to steal Internet users’ personal information and distribute email spam on a large scale. It’s not the first time a major news event has been tied to a upswing in malware distribution: malware distributors often take advantage of celebrity news or well-known events to encourage unwary users to open their messages and potentially make their computers vulnerable to exploitation. A well-known instance followed the devastation of New Orleans and southern Mississippi by Hurricane Katrina in 2005.

Computer security experts advise users to keep their security and antivirus software up to date, and not to open email attachments unless they’re expected.

When a user unwittingly activates a trojan horse, virus writers usually use the programs to search the user’s machine for email addresses and credit card information (both of which can be sold to cyber-criminals and others), then frequently use the computer as part of a “zombie” network to distribute more spam and viruses.