Tailor-made Zbot Spam Campaign Targets Various Companies

[Peaches]

Tailor-Made ZBOT Spam Campaign Targets Various Companies

by Christopher Talampas (Fraud Analyst)

Trend Micro threat analysts were recently alerted to a phishing attempt targeting random employees of several companies. The email posed as a notification from the company's "system administrator," reminding the employee to update his/her system's software due to a recent server software upgrade. The spammed email, like other phishing emails, contained a URL that led to users to a phishing site hosted on the several subdomains that resolved to the same IP address.

Trend Micro Advanced Threats Researcher Joey Costoya believes the subdomains are tailor-made, depending on the recipent's email address. This makes the email seem legitimate, even if it is not, tricking unknowing users into clicking the URL.

As of this writing, the URLs are already inaccessible. Trend Micro analyzed the domains and subdomains used in this attack and found that they are already blacklisted. The domain was registered for only one year.

Trend Micro Smart Protection Network™ already detects the malicious files as TROJ_ZBOT.CYX and blocks the spammed emails. Non-Trend Micro product users are, on the other hand, advised to use HouseCall, Trend Micro's highly popular and capable on-demand scanner for identifying and removing viruses, Trojans, worms, unwanted browser plugins, and other malware.