Tweet

The death of Korean leader Kim Jong Il resulted in an outpour of reactions from many people all over the world. Some people were saddened by the loss, while some were quite jubilant, saying that Kim Jong Il was “a repressive leader”.

Cybercriminals, on the other hand, only had one reaction to the incident—to take advantage of it.

Our researchers found spammed messages with email subjects mentioning the death of Kim Jong Il. The messages arrive with a .PDF attachment that has the file name brief_introduction_of_kim-jong-il.pdf.pdf. The said file is of course malicious and is detected as TROJ_PIDIEF.EGQ.

As part of its routines, TROJ_PIDIEF.EGQ opens a non-malicious PDF file to trick the user into thinking that it is a normal file. The .PDF contains a picture of Kim Jong Il.

Aside from this particular spam attack, we’ve also encountered malicious documents which bear file names mentioning the late Korean leader. One of the files we saw has the file name Kim_Jong_il___s_death_affects_N._Korea___s_nuclear_programs.doc and is now detected as TROJ_ARTIEF.AEB. This file, when opened, drops another file into the system, one detected as BKDR_PCCLIEN.BQD. BKDR_PCCLIEN.BQD connects to its C&C server through port 8000.

Here at TrendLabs, the death of a globally known person has become an automatic trigger for us to look for attacks trying to taking advantage of it. Hence, we are always on the lookout to protect our customers who are trying to look for more information. Such events generate global interest in a very short amount of time, so they make very good social engineering lures.

Under such circumstances, everyone is advised to stick with trusted sources when trying to get more information about noteworthy events. Trend Micro users are already protected from the abovementioned attacks through the Trend Micro™ Smart Protection Network™, as both the spammed messages and the malicious files are already blocked and detected respectively.

Other political figures whose deaths were also used by cybercriminals as lure include:

• Osama bin Laden
• Moammar Gadhafi
• Benazir Bhutto

Update as of December 20, 2011, 11:04 PM:

Further analysis by Threat Response Engineer Erika Mendoza revealed that TROJ_PIDIEF.EGQ drops a malicious file detected as BKDR_FYNLOS.A. The said backdoor connects to its C&C server to receive and execute commands such as downloading,uploading, and executing of files, terminating processes, and performing shell commands.

TROJ_PIDIEF.EGQ also exploits the following vulnerabilities affecting Adobe Reader and Acrobat:

• CVE-2010-2883
• CVE 2011-0611

Users are advised to patch their systems accordingly to prevent being victimized by the mentioned attacks.