Boston Marathon/West, Texas Spam Campaigns

There is a new spam campaign in circulation using the Boston Marathon bombings that occurred on April 15, 2013 as a lure. Users are sent an e-mail encouraging them to a watch a video of the explosion. When the user clicks on the enclosed link to watch the video malware is installed on the user’s computer.

 

The following URL patterns have been found in these e-mails:
http://[IP-address]/boston.html 

http://[IP-address]/news.html

 

When the user clicks on one of the links the Kehlios worm is installed on the user’s system which has the capacity to send spam; carry out Distributed Denial of Service Attacks; and steal online currency such as bitcoins. Most major anti-virus vendors have signatures for detecting this malware so users should keep their antivirus programs up-to-date.

 

In addition to the Boston Marathon spam campaign, a West, Texas plant explosion spam campaign has also sprung up. This spam campaign uses similar exploitation techniques as the Boston Marathon spam campaign previously described.  Subject lines of spam e-mails have been modified to contain content relative to the West, Texas plant explosions.  The following URL pattern is included within spam emails to lure users to malicious sites. 

 

http://[IP-address]/texas.html 

http://[IP-address]/news.html

 

Subject lines used in the spam emails:

·         2 Explosions at Boston Marathon;

·         Aftermath to explosion at Boston Marathon;

·         Boston Explosion Caught on Video;

·         "BREAKING - Boston Marathon Explosion";

·         "Video of Explosion at the Boston Marathon 2013";

·         "Runner captures. Marathon Explosion";

·         2 Explosions at Boston Marathon;

·         Aftermath to explosion at Boston Marathon;

·         Arbitron. Dial Global. Boston Bombings;

·         Boston Explosion Caught on Video;

·         BREAKING - Boston Marathon Explosion;

·         Explosion at Boston Marathon;

·         Explosion at the Boston Marathon;

·         Explosions at Boston Marathon;

·         Explosions at the Boston Marathon;

·         Opinion: Boston Marathon Explosions made by radical Gays? Really? - CNN.com;

·         Opinion: Boston Marathon Explosions - Romney Benefits? - CNN.com;

·         Opinion: Boston Marathon Worse Sensation - Osama bin Laden still alive!? - CNN.com;

·         Opinion: FBI knew about bombs 3 days before Boston Marathon - Why and Who Benefits? - CNN.com;

·         Opinion: Osama Bin Laden video about Boston Marathon Explosions - bad news for all the world. - CNN.com.