New Spam Attack Exploits Edunet Servers

May 5, 2008 – 3:04 PM

Researchers have discovered a new, complex spam attack that uses a sophisticated ruse to fool users into downloading malware.

The exploit, which researchers at BitDefender call “a spam-sending scheme of Byzantine complexity,” features spam messages that claim to contain links to videos. When users try to click and see the video, they are instead prompted to download a “media player.”

The download is in fact Backdoor.Edunet.A, a piece of malware that uses victims’ computers as a channel for sending commands to a series of mail servers. The mail servers, which are used to spread spam, are mostly in the .edu and .mil domains, BitDefender says.

The list of servers is retrieved by the Trojan from a series of Web servers that are either compromised themselves or part of the attackers’ own network. The list of Web servers is continuously changing, but that of the targets has, so far, remained constant, the researchers say.

The Trojan sends the commands in the hopes of finding an open relay — a misconfigured mail server that allows anyone to send messages — which makes it appear that any mail originating from the Trojan has actually been sent from the open relay.

BitDefender researchers have determined that, at least currently, none of the servers in the current target list are actually vulnerable.

“It’s not every day that you stumble on the workings of an honest-to-God hacking ring, let alone one that has a predilection for using military and university-run mail servers as spam relays,” declared Sorin Dudea, BitDefender’s head of antivirus research. “It would be interesting to identify what, if anything, the institutions that own the targeted servers have in common.”

Source: Dark Reading