Spammers use Boston bombing, Texas fires and other human tragedy to spread malware

And in this week’s edition of “Dirtbags of the Internet,” malware spammers are using the Boston Marathon bombing to spread malicious programs. 

How are they doing it? They send messages out with subject lines promising a video of the explosions. And if you click on them, you do see genuine footage of the blasts – while a Windows Trojan Horse infects your computer. Security experts Sophos’ Naked Security blog details how the malware works – and  Betabeat counseled readers to pass this information along to AOL-using aunts and forward-enthusiast uncles.  

Watch out for emails labeled “Aftermath to explosions at Boston Marathon” and “Explosions at Boston Marathon” – even if they appear to be normal, working links, they may still liberally douse your computer in malware. 

Malwarebytes.org reported that the Boston explosion wasn’t the only horrible thing to happen last week that scammers exploited. They also used the large-scale factory fire in West, Texas as bait for digital rubberneckers, promising footage of the blaze but secretly infecting people who clicked.

We talked to Malwarebytes’ Senior Security Researcher Jerome Segura, who confirmed our suspicions that the same people behind the bombing malware are behind the Texas bait. “It is correct to assume the same guys are behind the Boston Marathon and Texas explosion fake emails. The spam emails came from at least two botnets: Kelihos and Cutwail which sent an unusual amount of spam following each event. It’s worth noting that both of these botnets had been previously shutdown but have come back to life. There are many different groups behind these attacks, but most of them are located in Eastern Europe.”

And there’s more dirtbaggery afoot: According to Boston Magazine, someone is trying to sell a Facebook page memorializing the Boston bombing for $1,000, an example where greed completely tramples good taste and human decency.

“When users click the link to view these videos, they get redirected to a site that contains the Redkit exploit kit, a platform used to run multiple exploits on the victims’ machines and take advantage of one of many vulnerabilities in the browser and its plugins,” Segura explains. 

“Once the machine is compromised, malware is downloaded and run. In this particular case we observed fake antivirus as well as the ZeroAccess Trojan. The former scares the victim into thinking their PC is infected and blocks access to many programs. The goal is extort between $30 to $80 out of their victims. The latter is more discrete and uses the computer’s resources to mine bitcoins, a digital currency obtained by conducting digital computations requiring a lot of computing power and therefore slowing down to a crawl the victim’s PCs.”

People have always tried to capitalize on tragedies, and the Internet just makes it a lot easier. Although news like this can be seriously disheartening, it’s important to remember that for every fake Boston Marathon Twitter account trolling for RTs, there were more people seriously looking for ways to help victims. 

And if you’re still bummed out, read the wise words Patton Oswalt posted on his Facebook page after the incident: