Cutwail botnet authors behind wave of malicious IRS spam

Share this article:
Researchers at an email security firm warned Wednesday of a new spam run that seeks to infect machines by tricking users into believing the U.S. Internal Revenue Service (IRS) is trying to contact them over a fraudulent incident.

The bogus emails, being sent at a rate of 90,000 per hour, are trying to seed U.S.-based machines with Cutwail, the world's highest-volume spam-sending botnet, Sam Masiello, vice president of information security at MX Logic, told SCMagazineUS.com on Wednesday.

The subject of the messages falsely informs recipients that they have under-reported their incomes, resulting in fraud, and the body contains a link inviting users to review their tax statement on the IRS website, he said. If they click on the link, victims are directed to a mock website that contains additional links. If they then click on one of those, a trojan is downloaded. Detection rates currently are limited for the variant used in the attacks.

"They're trying to entice the user to react before they can think," Masiello said, adding that the emails are not specifically targeting any businesses, as spear phishing campaigns have done in the past.

Nancy Mathis, an IRS spokeswoman, told SCMagazineUS.com on Wednesday that it was aware of the scam and that recipients should forward the emails to phishing@irs.gov.

"Our message to people is to beware of emails purporting to be from the IRS," she said. "The IRS does not send unsolicited emails. We do not seek personal or financial information through emails."

This is not the first time that the IRS has been picked on by malware writers. In February, it was the source of a phishing campaign involving stimulus-package payments.

"Please remember that the IRS does not know your email address and will not conduct official business with you over email," Masiello said Wednesday in a blog post, which contained screen shots of the spam. "Any email purporting to do so is a scam and should be deleted immediately."



Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

VBA malware on rise, templates make it easier to write code

VBA malware on rise, templates make it easier ...

Researchers at SophosLabs found an uptick in VBA samples in July.

Analysts spot 'Critolock,' ransomware claims to be CryptoLocker

Trend Micro noted several differences between Critolock and CryptoLocker, however.

Citadel used in APT attacks against petrochemical firms

Citadel used in APT attacks against petrochemical firms

In an interesting twist, financial malware Citadel was used to infect firms outside of the finance sector via APT attacks, Trusteer found.