Malware maelstrom menaces UK
Email security firm MessageLabs has blocked more than a thousand copies of an email worm called Breatel-A (AKA Reatle or Lebreat) which attempts to launch a denial of service attack on security vendor Symantec and opens up a backdoor on infected PCs. The virus is being sent with multiple attachment types, including many .cpl files (Windows Control Panel Files) that may not automatically be blocked by some content filters and firewalls as they are not widely used by virus writers.
Typically the infected emails pose as messages that can't be delivered or supposed problems with a user's email or bank account, both common virus writing ploys. The first copies of the virus blocked by MessageLabs originated in Northern Ireland.
And that's not all. More than 120,000 emails containing a downloader Trojan – called Small-BDQ - have been sent to UK businesses since Saturday night (16 July), according to email security company BlackSpider Technologies. Firms targeted vary in size and industry with the attack continuing into Monday morning (18 July). The content of the email poses as a message from a user's sys admin warning that their system has been compromised and is distributing spam. The attachment is a packed executable MEW file called zam.exe. The attachment (just 2.8KB) is programmed to download the main Trojan payload from the web.
