Spammed malware poses as CCTV still of a rapist
January 30, 2006
Trojan horse messages targeting university addresses has appeared at Yale and at other universities across the US and UK. One targets a person's ego and the other purports to describe a rape incident on some campus.
The Brepibot variant is being actively spammed. What's interesting about it is that it seems to be targeting universities. Also, it seems that the author is constantly producing new variants of the bot.
This bot is working the heavily the social engineering side and playing on the emotions of its targets. It may have one or a variant of the following subjects:
Photo and Article
Fwd: Campus Student Raped
Fwd: CCTV still of Rapist
Fwd: Rape on Campus
Campus Student Raped
CCTV still of Rapist
Rape on Campus
Do you recognise this person?
Here are a couple of the message bodies:
Hello,
We are planning to include you in the new campus magazine in an article titled "Campus Life". Can you approve the photo and article for us before we go to printing please?
If any details are wrong then we can amend before printing on Wednesday the 1st of February so please get back to us as soon as possible.
We have attached the photo and article.
Many Thanks & Best Regards,
Joseph Hope
Editor
Hello,
During the early morning of January 25 2006, a campus student was the victim of a horrific sexual assault within college grounds. Eyewitnesses report a tall black man in grey pants running away from the scene. Campus CCTV has caught this man on camera and are looking for ways to identify him. If anyone recognises the attached picture could they inform administraion immediatly
Regards,
Robert Atkins
Campus Administration
Attached files containing the Trojan horse include "Suspects Photo.exe", "suspect image.exe", "CCTVstill.exe", "CCTV-footage.exe", and "suspicious photo.exe"
"Launching the attached file will not show you a CCTV picture of a rapist, but instead punch a hole in the security of your PC," said Graham Cluley, senior technology consultant at Sophos. "Hackers are reaching an all time low with this attempt to encourage kind well-meaning people into opening their malicious file. Anyone unfortunate enough to run this program is running the risk of allowing hackers to gain access to their computer to spy, steal and cause havoc."
E-mail this story
Printer-friendly version 
Bookmark this page
