Sober set to receive new instructions on Monday
After tearing through the Internet earlier this month by promising tickets for the 2006 World Cup in Germany, the Sober-N worm dropped the Sober-Q Trojan on compromised machines and began spewing messages of German nationalism. Now, CipherTrust researchers say, that Trojan will be receiving new instructions that could include a more destructive payload than merely sending out spam.
"The instructions in the code tell [the Trojan dropped by the last Sober variant] to stop sending current spam on the 23rd and to start searching for new code to send out," Dmitri Alperovitch, research engineer at CipherTrust, said in an e-mail. "That could lead to the launch of a new worm next week with undetermined functionality. The new worm may just turn infected machines into proxies that would be sold to spammers or phishers." He advises sysadmins to "get your filtering systems in place. Look at the source -- the IP addresses -- of machines that are sending this stuff out so you can block it.
