G DATA Software AG: Antivirus, Virenschutz, Virenscanner, Internet Security

Bochum (Germany), July 15th, 2008, After rumors about an alleged 3rd World War, yesterday an alleged cancellation of the Olympic Summer Games in Beijing has been announced. Referring to events and breaking news, criminals are trying to raise the hit rate of infections while at at same time expanding the Storm botnet.

Since yesterday morning, cyber offenders are spreading millions of mails worldwide with the subject: „Beijing Olympics cancelled, moved to Atlanta“. Furthermore, a one-liner in the body of the mail is announcing the crash of a Boeing passenger airplane in Michigan.

The link included in the mail points to a captured web server which originally belongs to a team of Argentinian industrial psychologists.That website displays a page full of porn videos. The website mentions that a particular video codec is necessary to correctly watch the videos. Instead of „breaking news“ or smut movies, malware (Trojan.Downloader.Win32.Agent.vyi, amongst others) is installed which is of course trying to capture the infected system and connect it to the Storm botnet.

Screenshot: Storm E-Mail

Along with the linked and faked web page, attackers have obviously hacked the whole website. When trying to browse themain landing page of the hacked domain, a drive-by-download is initiated: another attempt to install malicious code

onto the victims‘ systems.

Screenshot: cracked and manipulated website

G DATA security solutions detect this new threat. Nevertheless G DATA recommends to delete such mails unread.