Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    September 2015
    S M T W T F S
    « Aug    
  • Email Subscription

  • About Us

    No sooner had the world learned of the untimely death of Heath Ledger (Brokeback Mountain) than malware authors started using the late actor’s name as a social engineering ploy. Within hours of these reports, Research Project Manager Ivan Macalintal discovered a couple of malicious URLs that turn up when users key in the search terms “heath” and “ledger”:

    {google heath}

    This is very similar to the poisoned Google searches reported last Christmas. If a user clicks on any of the links, he is led to the following SEO (search engine optimization) keyword-riddled page:

    {google heath}

    However, the user doesn’t even get to see this, as this page automatically redirects to another site. This site requires the user to download a “new version of ActiveX Object.” As expected, this is just the beginning of a series of redirections that end in the download of different malicious files (like TROJ_RENOS.LZ in one infection chain, and WORM_NUCRP.GEN in another).

    {google heath}

    There seems to be a bigger story behind this particular attack. Upon deeper analysis, researchers find reason to believe that these malicious URLs are among those resulting from the suspected hacking of Web servers of a certain Czech hosting provider. Hacked sites residing in these servers carry a malicious JavaScript code (detected by Trend Micro as JS_DLOADER.DAT), which, when accessed, follow the same redirection algorithm as the Heath Ledger links above.

    Piggybacking on newsworthy events is not new. A month ago, malware authors also jumped on the assassination of Pakistan Prime Minister Benazir Bhutto. In this case, malware authors simply used news of Ledger’s death to jumpstart massive redirections as they know many people are wont to do searches on this hot news item.

    Trend Micro’s Web Threat Protection provides various defenses at different points of the infection story: our Web Filtering technology blocks access to malicious sites, and our scan engine detects the JavaScript launching the attack, and the files which this malware attempts to eventually download onto the affected system.

    Communication with Czech CERT has already been initiated by our analysts to properly inform affected parties in this massive hacking incident.

    Information and screenshots provided by Ivan Macalintal and Threat Response Engineer Maersk Menrige
    Write-up updated by Ma. Christina Cruz

    Share this article
    Get the latest on malware protection from TrendLabs
    Email this story to a friend   Technorati   NewsVine   MySpace   Google   Live   StumbleUpon


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice