The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1
Latest posting
By rating
By popularity

Join our blog

You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings.


It's been a while since the last massive Internet outage took down Syria’s backbone network (AS29386). More recently, however, Syria suffered yet another large-scale Internet black out that lasted for about seven hours. In contrast to previous incidents, where networking routes began to disappear gradually from border routing devices, this time a cut off fiber optic cable was deemed responsible for leaving most of the country off-line.

Given the complexity of the current political situation, there are many different factors which could be involved in this event, but from the outside these are all largely speculative. Pro-government groups will talk about sabotage and opposition activists will talk about censorship. Here, we'll only focus on malware and the facts that have been found during the analysis, presenting only relevant information in the hope of setting a clear context for this research.


Spammers are relentless in their attempts to bypass anti-spam filters and confuse recipients of spam. Recently we detected a mass mailing disguised as an automated reply to a request to unsubscribe from a news blog. The authors noted their regret at losing one of their subscribers and asked if the user really wanted to unsubscribe.


Phrases like “We regret your decision to unsubscribe” do indeed appear in responses sent following requests to unsubscribe. However, there followed some unusual text in which the senders also regretfully informed the recipient that they had also unsubscribed him from other information mailings on subjects such as:

  • Driving licenses without medical certificates
  • Bankruptcy procedures for legal entities
  • Bank licenses
  • Setting up businesses abroad
  • Real estate with a 50% discount

These are typical spam topics which, in this case, were disguised as information blocks. Why were the messages so suspicious? Because the senders didn’t even mention the name of the blog, site or journal from which the user was supposed to have unsubscribed.

The name of the unsubscribed service wasn’t in the sender’s domain name either – the address contained only one phrase that translates as “driving license right now” (spammers frequently use words related to the topic of the message in new domains), and the messages were sent in the month the domain was created. There were no links to prolong the subscription. It looks like the spammers thought that any interested users would reply to the message and receive a whole variety of spam mailings related to the chosen topic.

An even more insolent mailing stated that for a certain amount of money the spammers would tell the recipient how they found out his/her email address and why the mail box was full of spam messages. The information cost just $3.50. In order to pay for the information, the user had to click a link at the end of the message.


The link led to the site called End of Spam where the user could view a full pricelist. For instance, the user could remove his/her email address from spam mailing lists for a $1.50 payment via PayPal. Information on how the spammers found out about the user’s email address cost $3.50. The fraudsters reminded the user to state their email address so that they “know which email address to unsubscribe”.


All of the links led to a PayPal page with a set payment document. If the user was already authorized in PayPal system, he/she simply had to press the button “Buy Now” and transfer his/her money to goodness knows where.

Of course, this is unlikely to halt the spam mailings – it’s hard to believe that the senders know all the spammers in the world and can stop their mailings at the request of a user. Besides, after the money transfer, the stream of unsolicited correspondence may even increase after the address is confirmed as being valid and the user’s naivety is noted. In the worst case scenario, the user’s personal data from the money transfer payment could be used.

comments      Link

There are plenty of fraudulent messages with the content along the lines of “your email address won a million dollars in a lottery, please contact us to claim your prize”. Internet scammers use this trick to trick users into giving away money: before they can claim their alleged prize the “lucky winners” have to pay tax or a bank charge for a money transfer, etc.

We have now come across an interesting variation of this trick, which involves a Facebook account instead of an email address.

Now, why does Eduardo Saverin (a real person and one of the founders of Facebook) need to know my Facebook username if my account has already won a prize? But an unsuspecting user, blinded by the promise of a huge prize, may not think about that – and that’s what the scammers are counting on.

I’m sure the readers of this blog wouldn’t fall for something like a “Facebook prize”, but our relatives and friends have accounts too, and they may not be so experienced in the ways of online fraud. That’s why they should be warned that such letters are nothing but a scam.

comments      Link

In our practice, we often encounter cases where messages with a malicious attachment are mass-mailed to many addresses at the same time. Recently, though, we saw a series of messages persistently sent to the same email address. Apparently, the attacker’s main goal was to infect that computer – all emails, no matter what their headers were, contained Email-Worm.Win32.NetSky.q. This worm’s characteristic feature is that it spreads via email attachments. After infecting a computer, the worm finds all the email addresses in it and copies itself to them, using specific short phrases and avoiding any email addresses that may be directly associated with IT security providers, such as antivirus companies.

The first message we detected purportedly came from the PayPal payment system. The text in the body of the letter said that there was a bill for the user in the attachment.



We just received a spam message in Portuguese stating the following:

In short, this message says that WhatsApp for PC is finally available and that the recipient already has 11 pending invitations from friends in his account. This is what the email looks like:



Today we got a spam message with a fake e-card in Portuguese leading to an interesting piece of malware:

Header translation: You got a Christmas e-card. Somebody very special has sent this Christmas e-card for you. In case you are not able to visualize it, click here. Much better than any present is a happy family.


Companies are increasingly falling victim to cyber-attacks. According to a recent survey conducted by Kaspersky Lab and B2B International, 9% of the organizations polled were the victims of targeted attacks - carefully planned activity aimed at infecting the network infrastructure of specific organization. The extensive use of digital devices in business has created ideal conditions for cyber-espionage and the deployment of malware capable of stealing corporate data.

The full report is available here.

Comment      Link

Spam Test|Stealing user's password with Free Online Forms

Dmitry Bestuzhev
Kaspersky Lab Expert
Posted November 06, 16:17  GMT
Tags: Social Engineering, Email

I just received a spam e-mail in Portuguese stating that my mailbox had exceeded its maximum storage.

Translation: Attention! Your email box has exceeded the 20Gb storage limit set by the Administrator. At this moment you are using 20,9Gb and can’t send or receive new messages unless you revalidate your email inbox.
Please click on or copy the link below to revalidate and to update it.
You have to access your email box via the link below to update and revalidate your email inbox.
Thank you,
Email Administrator.


New trick from cybercriminals of Brazil - a suspicious message arrives to the user with a file attached named "Comprovante_Internet_Banking.rtf", translated from Portuguese it means "Receipt from Internet Banking":

Are you waiting a banking receipt via email?


The emergence of small groups of cyber-mercenaries available for hire to perform surgical hit and run operations.

The world of Advanced Persistent Threats (APTs) is well known. Skilled adversaries compromising high-profile victims and stealthily exfiltrating valuable data over the course of many years. Such teams sometimes count tens or even hundreds of people, going through terabytes or even petabytes of exfiltrated data.

Although there has been an increasing focus on attribution and pinpointing the sources of these attacks, not much is known about a new emerging trend: the smaller hit-and-run gangs that are going after the supply chain and compromising targets with surgical precision.

Since 2011 we have been tracking a series of attacks that we link to a threat actor called ‘Icefog’. We believe this is a relatively small group of attackers that are going after the supply chain -- targeting government institutions, military contractors, maritime and ship-building groups, telecom operators, satellite operators, industrial and high technology companies and mass media, mainly in South Korea and Japan.