Online Casino, Geocities, and Waledac | Malware Blog

Targeted Attacks
- Hiding in Plain Sight: A New APT Campaign
- Backdoor Built With Aheadlib Used In Targeted Attacks?
- Malicious PDFs On The Rise
- Targeted Attack Campaign Hides Behind SSL Communication
- New Wave of PlugX Targets Legitimate Apps

Mobile
- Get Free Followers! on Instagram? Get Free Malware, Survey Scams Instead
- Mobile Ads Pushed by Android Apps Lead to Scam Sites
- Finding Banking Trojans in Eastern Asia – Report From CeCOS VII
- How Mobile Malware Uses The Web
- (Lack of) Android Updates To Come Under FTC Scrutiny?

May 2013
S	M	T	W	T	F	S
« Apr
	1	2	3	4
5	6	7	8	9	10	11
12	13	14	15	16	17	18
19	20	21	22	23	24	25
26	27	28	29	30	31

Trendlabs Security Intelligence > Online Casino, Geocities, and Waledac

Apr15

Online Casino, Geocities, and Waledac

9:53 pm (UTC-7) | by Jonell Baltazar (Senior Threat Researcher)

Deviating from Conficker/Downad update and jigsaw puzzle menace, Waledac updated its spam emails and is now spamming online casino advertisements.

The spammed email contains a URL link to a Yahoo! Geocities web page which is shown in Figure 4, and when the link “Play now” is clicked, it shows a casino related image ad as shown in Figure 5.

There is no activity seen where Waledac is seeding URLs that links to a new Waledac binary for this specific spam run, but our radars are actively monitoring for this event. The following spam emails however, are now blocked by the Smart Protection Network.