Gumblar Attack Is Alive, Worse Than Conficker

[Peaches]

May 28, 2009 5:29 PM PDT

Experts: Gumblar attack is alive, worse than Conficker

by Elinor Mills

"The Web site compromise attack known as Gumblar has added new domain names that are downloading malware onto unsuspecting computers, stealing FTP credentials to compromise more sites, and tampering with Web traffic, a security firm said on Thursday.

The Gumblar attack started in March with Web sites being compromised and attack code hidden on them. Originally, the malware downloaded onto computers accessing those sites came from the gumblar.cn domain, a Chinese domain associated with Russian and Latvian IP addresses that were delivering code from servers in the U.K., ScanSafe said last week. "

Read more at CNET - http://news.cnet.com/security/