More stock (s)[p] {m}!

Most recent spammer innovations have centered around “pump and dump spam”. This is what spammers were mass-mailing out in those .pdf and .fdf attachments that we’ve seen recently. And this is the spam that comes in graphics files, with the text often rotated several degrees, and other spammer tricks.

And now we’ve seen the latest innovation, which really had me scratching my head. This spam is designed for die-hard puzzlers: the spammers have taken a very strange approach – splitting key words, such as ‘stock’, ‘buy’ etc. with non-alphabetic characters. The problem is that the plethora of non-letter symbols – curved brackets, asterisks etc. – make it very hard to read the text. In fact, someone would have to be extremely motivated to read such an email all the way through.

Of course, spammers are just trying to get round spam filters to deliver their message to end users. But they seem to have forgotten one very simple rule – it’s not enough simply to get the spam to the mail box, the user has to read it, too! And who is going to plough their way through a strange message crammed with a variety of brackets and other out of place punctuation marks?

If we take a look at the history of spam evolution, we can see that this isn’t something totally new. In 2003, spammers conducted similar experiments, littering their emails with symbols and non-Latin letters, resulting in messages that looked like this:

Vl/GR/| $0.95 /l)0SE
C|/|L|S $2.00 /|)0SE
}{E|||C/lL $0.91 /l)()SE
PR()PECl/|GR/, GLUC()PH/|GR/|GE, V|0} {}{,
CELEBRE}{, |/|ERl|)l/, Z()L0FF, P/l}{lL, LlP|T()R
E ll T E R

The result was almost unreadable emails, which quickly disappeared from the scene. Spammers clearly decided that this wasn’t a promising approach. However, either they got some return on their mass-mailings, or what we’re seeing now is a new generation of spammers who haven’t learnt from the mistakes of the past. We’ll see how long this latest wave lasts.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.