Stratfor subscribers targeted by malware-ridden emails

Share this article:

A letter addressed to the stolen email addresses of Stratfor customers claims to be a helpful reminder of malware scams, but is actually bait to spread the Zbot trojan.

The devastating breach of global affairs firm Stratfor last last year continues to reap rewards for its purveyors.

As members of Anonymous sort through the 5.2 million plundered emails to find evidence of secret correspondences among the intelligence, military and government sectors, more financially motivated hackers are again on the attack.

This time, according to the Microsoft Malware Protection Center on Monday, online miscreants are leveraging the stolen subscriber list -- complete with names and emails  of 860,000 people -- to send malware-infested messages.

Security researcher Rodel Finones said the emails arrive with an attachment, titled "stratfor.pdf." Clicking on the attachment opens a letter directed to "Stratfor readers" that, ironically, claims to warn them of the possibility that phishers may send them emails containing viruses. 

To remedy themselves, recipients are encouraged to click on a dubious link contained in the letter, one which leads to a compromised site hosted overseas, possibly in Turkey or Poland, which attempts to distribute a variant of the Zbot, or Zeus, trojan.

Zbot is known for its ability to siphon information from a compromised user's machine.

As a result of this wave of malicious emails, Stratfor is implementing a no-link-or-attachment rule when sending emails to subscribers, CEO George Friedman said in an apology letter.

"Be assured," he wrote. "Our website -- -- is the most secure place for you to interact with us. You can visit us by typing into your browser."

Late last month, Austin, Texas-based Stratfor was hit with a $50 million lawsuit from customers whose credit card information was lost in the attack, according to published reports.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.