Skip to main content

Spammers use Boston bombing, Texas fires and other human tragedy to spread malware

Screen Shot 2013-04-22 at 10.51.50 AMAnd in this week’s edition of “Dirtbags of the Internet,” malware spammers are using the Boston Marathon bombing to spread malicious programs. 

How are they doing it? They send messages out with subject lines promising a video of the explosions. And if you click on them, you do see genuine footage of the blasts – while a Windows Trojan Horse infects your computer. Security experts Sophos’ Naked Security blog details how the malware works – and  Betabeat counseled readers to pass this information along to AOL-using aunts and forward-enthusiast uncles.  

Recommended Videos

Watch out for emails labeled “Aftermath to explosions at Boston Marathon” and “Explosions at Boston Marathon” – even if they appear to be normal, working links, they may still liberally douse your computer in malware. 

Malwarebytes.org reported that the Boston explosion wasn’t the only horrible thing to happen last week that scammers exploited. They also used the large-scale factory fire in West, Texas as bait for digital rubberneckers, promising footage of the blaze but secretly infecting people who clicked.

We talked to Malwarebytes’ Senior Security Researcher Jerome Segura, who confirmed our suspicions that the same people behind the bombing malware are behind the Texas bait. “It is correct to assume the same guys are behind the Boston Marathon and Texas explosion fake emails. The spam emails came from at least two botnets: Kelihos and Cutwail which sent an unusual amount of spam following each event. It’s worth noting that both of these botnets had been previously shutdown but have come back to life. There are many different groups behind these attacks, but most of them are located in Eastern Europe.”

And there’s more dirtbaggery afoot: According to Boston Magazine, someone is trying to sell a Facebook page memorializing the Boston bombing for $1,000, an example where greed completely tramples good taste and human decency.

“When users click the link to view these videos, they get redirected to a site that contains the Redkit exploit kit, a platform used to run multiple exploits on the victims’ machines and take advantage of one of many vulnerabilities in the browser and its plugins,” Segura explains. 

“Once the machine is compromised, malware is downloaded and run. In this particular case we observed fake antivirus as well as the ZeroAccess Trojan. The former scares the victim into thinking their PC is infected and blocks access to many programs. The goal is extort between $30 to $80 out of their victims. The latter is more discrete and uses the computer’s resources to mine bitcoins, a digital currency obtained by conducting digital computations requiring a lot of computing power and therefore slowing down to a crawl the victim’s PCs.”

People have always tried to capitalize on tragedies, and the Internet just makes it a lot easier. Although news like this can be seriously disheartening, it’s important to remember that for every fake Boston Marathon Twitter account trolling for RTs, there were more people seriously looking for ways to help victims. 

And if you’re still bummed out, read the wise words Patton Oswalt posted on his Facebook page after the incident: Screen Shot 2013-04-22 at 11.13.37 AM

Kate Knibbs
Former Contributor
Kate Knibbs is a writer from Chicago. She is very happy that her borderline-unhealthy Internet habits are rewarded with a…
Bluesky finally adds a feature many had been waiting for
A blue sky with clouds.

Bluesky has been making a lot of progress in recent months by simplifying the process to sign up while at the same time rolling out a steady stream of new features.

As part of those continuing efforts, the social media app has just announced that users can now send direct messages (DMs).

Read more
Reddit just achieved something for the first time in its 20-year history
The Reddit logo.

Reddit’s on a roll. The social media platform has just turned a profit for the first time in its 20-year history, and now boasts a record 97.2 million daily active users, marking a year-over-year increase of 47%. A few times during the quarter, the figure topped 100 million, which Reddit CEO and co-founder Steve Huffman said in a letter to shareholders had been a “long-standing milestone” for the site.

The company, which went public in March, announced the news in its third-quarter earnings results on Tuesday.

Read more
Worried about the TikTok ban? This is how it might look on your phone
TikTok splash screen on an Android phone.

The US Supreme Court has decided to uphold a law that would see TikTok banned in the country on January 19. Now, the platform has issued an official statement, confirming that it will indeed shut down unless it gets some emergency relief from the outgoing president.

“Unless the Biden Administration immediately provides a definitive statement to satisfy the most critical service providers assuring non-enforcement, unfortunately TikTok will be forced to go dark on January 19,” said the company soon after the court’s verdict.
So, what does going dark mean?
So, far, there is no official statement on what exactly TikTok means by “going dark.” There is a lot of speculation out there on how exactly the app or website will look once TikTok shutters in the US.

Read more