Fake E-cards and the Storm Worm

If you've gotten a mysterious e-card lately, there's a good chance it was sent by a computer infected by the Storm Worm.

These e-cards claim to be from established card senders, but in reality have no connection with them. Often these messages are deleted by spambusters or other security software. If for no other reason, they look like e-cards, which themselves often look like spam.

The worm originally appeared in early 2007, but has become far more prolific as of recent. Security firm SecureWorks claims that the number of infected addresses has jumped from a few thousand up to nearly 2 million.

If the user proceeds to click the link to view their e-card, it takes them to a webpage which contains malicious code. In certain circumstances, their system will also become infected. The worm may also be spread by attachments containing ZIP files.

In addition to simply spreading the worm, systems can be commanded remotely to do their new owners' bidding. This can include launching denial-of-service attacks or sending spam mail. Many of the PDF-based junk emails have been attributed to systems infected by the Storm Worm. Usually e-cards sent from by Storm can be easily identified by the fact that they link directly to an IP addresses instead of the company claiming to have sent the card.

As a rule of thumb, don't open any attachments or follow any links contained within messages you weren't expecting.

Back