Stratfor subscribers targeted by malware-ridden emails

Share this article:

A letter addressed to the stolen email addresses of Stratfor customers claims to be a helpful reminder of malware scams, but is actually bait to spread the Zbot trojan.

The devastating breach of global affairs firm Stratfor last last year continues to reap rewards for its purveyors.

As members of Anonymous sort through the 5.2 million plundered emails to find evidence of secret correspondences among the intelligence, military and government sectors, more financially motivated hackers are again on the attack.

This time, according to the Microsoft Malware Protection Center on Monday, online miscreants are leveraging the stolen subscriber list -- complete with names and emails  of 860,000 people -- to send malware-infested messages.

Security researcher Rodel Finones said the emails arrive with an attachment, titled "stratfor.pdf." Clicking on the attachment opens a letter directed to "Stratfor readers" that, ironically, claims to warn them of the possibility that phishers may send them emails containing viruses. 

To remedy themselves, recipients are encouraged to click on a dubious link contained in the letter, one which leads to a compromised site hosted overseas, possibly in Turkey or Poland, which attempts to distribute a variant of the Zbot, or Zeus, trojan.

Zbot is known for its ability to siphon information from a compromised user's machine.

As a result of this wave of malicious emails, Stratfor is implementing a no-link-or-attachment rule when sending emails to subscribers, CEO George Friedman said in an apology letter.

"Be assured," he wrote. "Our website -- Stratfor.com -- is the most secure place for you to interact with us. You can visit us by typing Stratfor.com into your browser."

Late last month, Austin, Texas-based Stratfor was hit with a $50 million lawsuit from customers whose credit card information was lost in the attack, according to published reports.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.