PresseBox
Press release BoxID: 176555 (MessageLabs GmbH)
  • MessageLabs GmbH
  • Konrad-Zuse-Platz 2-5
  • 81829 München
  • http://www.messagelabs.com
  • Contact person
  • Alexandra Maiberger
  • +49 (89) 53 29 57-0

The Storm Botnet Shares the Love with 81,000 Inboxes

(PresseBox) (Unterföhring, ) On 19 May 2008, MessageLabs intercepted a new wave of malware from the Storm Botnet which showered more than 81,000 victims with amorous messages of love. The emails were short in copy but spread the malware via a link to a file - iloveyou.exe - hosted on malicious website running the lightweight "nginx" web server (version 0.5.17), which has been specially ported to Windows for use on the Storm botnet.

With subject lines including "With All My Love", "If Loving You", "With Love", "We Belong together", "Our Love is Free", MessageLabs analysis reveals that the main locations of where the spam was being sent from, based on the IP addresses include - Peru, UK, Vietnam, Russia, Turkey, US and the Netherlands. This run accounted for approximately 1% of all spam on this date which suggests that Storm spam is between 1 and 2% of all spam.

Although it doesn't look like the surge in storm malware mails has resulted in a surge in spam, however this is a typical watch-and-wait scenario as if many more machines become infected with Storm we may see an increase in storm spam over the coming weeks.

MessageLabs customers were protected form this attack due to Skeptic(TM) , MessageLabs proprietary search engine, however unfortunately it is expected that there are hundreds of thousands of emails in the wild as only 8 out of 32 traditional virus engines managed to stop this attack.

Paul Wood, Senior Analyst at MessageLabs commented "The impact of this latest Storm attack remains to be seen however as Storm's authors have proven that they are able to bypass the majority of traditional antivirus tools in order to reach their targets, this attack should serve as a warning shot to those who are not securing both their email and web traffic properly".