Cutwail drives spike in malicious HTML attachment spam - Revision history

Eric.freyssinet: Text replacement - " labs.m86security.com" to ""

2015-08-05T20:57:31Z

Text replacement - " labs.m86security.com" to ""

← Older revision		Revision as of 20:57, 5 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://labs.m86security.com/2012/02/cutwail-drives-spike-in-malicious-html-attachment-spam/ ~~labs.m86security.com~~		\|Link=http://labs.m86security.com/2012/02/cutwail-drives-spike-in-malicious-html-attachment-spam/
	\|Author=Rodel Mendrez,		\|Author=Rodel Mendrez,
	\|NomRevue=M86 Security Labs Blog		\|NomRevue=M86 Security Labs Blog

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:24Z

1 revision imported

← Older revision		Revision as of 14:23, 7 February 2015
(No difference)

Eric.freyssinet at 14:05, 19 August 2012

2012-08-19T14:05:23Z

New page

{{Publication
|Image=cutwailbackm86.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://labs.m86security.com/2012/02/cutwail-drives-spike-in-malicious-html-attachment-spam/ labs.m86security.com
|Author=Rodel Mendrez,
|NomRevue=M86 Security Labs Blog
|Date=February 16th, 2012
|Editor=M86 Security Labs
|Year=2012
|ISBN=
|Page=
|Abstract=Over the past month, we have observed several large spam campaigns with malicious HTML attachments. We believe the botnet behind these campaigns is Cutwail. Here is data we collected, starting from the first day of 2012, illustrating spikes of spam with malicious HTML attachments:
Attaching an HTML file to an email is a tactic we have seen used in phishing. But recently, attackers have spammed out large volumes of HTML attachments that include malicious JavaScript. Here is an example we received a few days ago:
In the image above, we opened message with the attached .HTM file using the Mozilla Thunderbird email client. Although Thunderbird rendered the HTML attachment, fortunately its default settings prevented the malicious JavaScript in the HTML source code from running. The Thunderbird user needs to click the attachment or open the HTML file in a browser for the JavaScript to run.
|Botnet=Cutwail,
|Malware=Cridex,
|ExploitKit=Phoenix
|CCProtocol=,
|Operation=,
|Keyword=Phoenix Exploit Kit, Spam,
}}