Hacked Computers Hit With Updated Spam Tool

Computers infected with a well-known virus began downloading a new spam tool Sunday night used by hackers to send unwanted e-mail.Virus writers who are part of the infamous Bagle spam gang began sending a new spamming tool Sunday night to thousands of hacked computers, said Mikko Hypponen, chief research officer for F-Secure, a security company based in Helsinki. If a computer is infected with the Bagle virus, a hacker can download other malicious programs to the machine. In turn, those programs can send out spam to other machines without the knowledge of the user.Once a computer is under their control, virus writers can upgrade the malicious software they have installed. Sunday night, machines infected with Bagle variants were downloading the new spam tool from a server in Slovakia hosting a real estate website.“This is the way virus writers can upgrade the infected machines,” Hypponen said. “It’s like [Microsoft’s] Windows update for viruses.”The download link was buried within the website, and it’s unlikely the owners had any idea it was being used. Sunday night, the link was cut off, Hypponen said.But within hours, a French site hosted in the United States was hosting a link with the malware, Hypponen said. The ISP hosting that site has been contacted, but so far the link remains active, he said.F-Secure uses automated tools to poll URLs used by virus writers to host bad malware, Hypponen said.About 99 percent are decoys, set up to throw off attempts to track them down. But when a site suddenly becomes active, Hypponen said, efforts are made to contact ISPs to shut them down.

— Jeremy Kirk, IDG News Service

For related news coverage, read FTC, Prosecutor Shutter Calif. Spam Operation and New Generation of IE Malware Now Circulating.

Keep checking in at our CSO Security Feed page for updated news coverage.