Another swine flu-related spam run was recently reported, this time targeting Japanese users. Aside from using the swine flu as its social engineering method, which has already been used in earlier spam runs, this spam run also uses a technique where the sender of the message appears to use the .yahoo.co.jp domain. This serves not only as a means to evade spam filters, but also to further fool the users that the message is legitimate, thus convincing them to open an attached malicious file.

Spammed messages with the subject Warning of Swine Flu claiming to be from the National Institute of Infectious Diseases, encourages users to open an attached .ZIP file, to “learn” more about the pandemic (detection available as TROJ_PIDIEF.UA and TROJ_PIDIEF.TY). Our engineers have verified that TROJ_PIDIEF.TY drops and executes BKDR_KUPS.G.

The real National Institute of Infectious Diseases issued a warning of the fake spam messages on their website to alert users who may get the deceiving message.

Here is a translation of the text contained in the spam message:
________________________________________________

From: National Institute of Infectious Diseases address@yahoo.co.jp
Subject: Warning of Swine Flu!
Attached file name: Information on the swine flu

National Institute of Infectious Diseases

________________________________________________

Users are strongly advised not to judge the legitimacy of an email simply by its content.

If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!