• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Bad Sites   »   Hundreds of Blogger Pages Harboring New Year’s Storm Links

Hundreds of Blogger Pages Harboring New Year’s Storm Links

  • Posted on:December 27, 2007 at 2:49 pm
  • Posted in:Bad Sites, Botnets, Exploits, Malware
  • Author:
    Paul Ferguson (Senior Threat Researcher)
3

Seeing how this is my first post to the Trend Micro malware blog, it is with some regret that it involves a renewed, year-end effort to increase the size of perhaps the most prolific botnet on the planet.

There appears to be two separate ongoing issues with malicious content and Blogger, the free Google blogging service.

The first one, which has been ongoing, but seemingly renewed with a vengeance, is the malicious nature of “fake” video which requires the user to install a new codec, and in turn, infects them with a ZLOB Trojan.

My colleagues over at Sunbelt Software blogged about this yesterday here.

However, in the past 24 hours, there seems to be hundreds of blogs which have appeared that now have singular links to a set of fast-flux servers that infects the user with the Storm Worm (a.k.a. NuWar — Trend Micro detects this as WORM_NUCRP.GEN). These “blogs” have nothing more than a reference to a “…Wishing You a Happy New Year…” or something similar, and a link to one of the server names which will infect the user with the Storm Worm.

Some of the “blogs” appear to be legitimate, some don’t — it’s hard to say. It’s also difficult to determine whether these are older blogs that haven’t been updated in a while (and somehow unauthorized access was gained to them), or perhaps bad guys just created a bunch of bogus blogs and planted this stuff, or what.

In any event, if you see any links like the ones in the partial screenshot above, don’t click on them.

And take a quick second or two to report them to Google as malicious.

Let’s have a safe & Happy New Year out there!

– Paul “Fergie” Ferguson, Advanced Threats Research

Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2019

  • Our security predictions for 2019 are based on our experts’ analysis of the progress of current and emerging technologies, user behavior, and market trends, and their impact on the threat landscape. We have categorized them according to the main areas that are likely to be affected, given the sprawling nature of the technological and sociopolitical changes under consideration.
    Read our security predictions for 2019.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire
  • Windows App Runs on Mac, Downloads Info Stealer and Adware
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures

Popular Posts

  • Going In-depth with Emotet: Multilayer Operating Mechanisms
  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.