85.6 percent of all unwanted emails in circulation during the first half of 2009 contained links to spam sites and/or malicious web sites.

Shopping remained the leading topic of spam (28 percent), followed closely by cosmetics (18.4%), medical (11.9%), and education (9.5%). Education themed spam has almost doubled over the previous 6 month period and some believe that is due to the recession. Often times these education themed emails seek to exploit people looking to gain new skills or obtain fake qualification to help their job prospects.

Malware-Infected CD Mailing was Part of Pen Test
By Dennis Fisher
The malware-infected CDs that were mailed to some credit unions may have been part of a penetration test designed to gauge whether an employee would run the software. The SANS Internet Storm Center says it was notified by a representative from Microsolved that the mailing was part of an authorized pen test.
The alleged scam is elegant in its simplicity. The potential thieves are mailing letters that purport to come from the National Credit Union Administration, the federal agency that charters and insures credit unions, and including two CDs in the package. The letter is a fake fraud alert from the NCUA, instructing recipients to review the training materials contained on the discs. Of course, the CDs are loaded with malware rather than training programs.
The letter contains some of the classic misspellings and miserable grammar often found in phishing emails. An excerpt of the letter:
The NCUA has warned numerous times 1 about “phishing” scams in which crooks send e-mails claiming to be from legitimate financial institutions, companies or government agencies asking consumers to “re-submit” or “verify” confidential information such as bank accounts, Social Security Numbers, passwords, and personal identification numbers…
Please read the included document, as it contains important training and informational material regarding the risks of fraud…
The NCUA has published an advisory about the fake CDs, warning credit union employees not to run the discs.
A federally insured credit union has reported receiving a bogus Letter to Credit Unions, accompanied by two compact discs (CDs). The subject of the fraudulent letter itself is a purported NCUA FRAUD Alert. The letter advises credit unions to review training material (contained on the CDs). DOING SO COULD RESULT IN A POSSIBLE SECURITY BREACH TO YOUR COMPUTER SYSTEM, OR HAVE OTHER ADVERSE CONSEQUENCES.
This kind of attack has been suggested and kicked around in the security community for years, but this is perhaps the first time in recent memory that it has actually surfaced. An interesting point here is that the thieves are targeting credit unions, which tend to be smaller, community-based institutions, rather than larger, more sophisticated banks. Many credit unions have just a handful of branches and may not have the dedicated security staffs that national banks have.
In effect, this is simply an offline extension of the highly targeted spear-phishing attacks that have been plaguing smaller financial institutions for a couple of years. But it’s one that’s potentially effective and damaging.

All of Kevin’s stuff is posted at security.perimeterusa.com

Microsofts Windwos 7 was the latest to have this happen, although this is far from the first time. Apple’s iWork ‘09 had something similar last year. My suggestion is to not download and use pirated software because the security implications can be huge. Remember, it isn’t just about that one system being infected. Once it is on the inside of your network, it can spread to other systems.

Article

The site became unavailable after this happened on May 4, 2009. The ransom note said they had 7 days. At this time I have not been able to find out any additional information on this, and the 7 days has long past. I don’t know if Virginia is keeping a good wrap on this, or something else is going on. Perhaps due to the investigation, they can’t release any additional information.

I believe we will begin to see more and more of this type of thing.

http://voices.washingtonpost.com/securityfix/2009/05/hackers_break_into_virginia_he.html?wprss=securityfix

http://www.informationweek.com/news/security/attacks/showArticle.jhtml?articleID=217201397&subSection=Cybercrime

According to the Websense announcement: “The malicious Web site that is redirected is typical: it asks the user to install a missing codec to watch a video, and the download codec is a Trojan Downloader. Until now, these kinds of sites just used hot topics to attract users; we suspect that they will use more advanced SEO techniques to infect more users in the future.”

http://health.yahoo.com/news/reuters/us_flu.html