World war III has started! US has invaded Iran! Click here to see the firsthand video!

Filed Under: SophosLabs, Spam

Don't worry readers, a new war hasn't started. What you see instead is the latest is the latest campaign from the Dorf (Storm) botnet. Just 4 days after after the Independence day fireworks campaign, the Dorf authors are back with a renewed campaign. This time they are taking advantage of the tension in the Middle East.

Here are some of the latest email subjects:

20000 US soldiers in Iran
Iran USA conflict developed into war
More than 10000 Iranians were murdered
Negotiations between USA and Iran ended in War
Occupation of Iran
Plans for Iran attack began
The Iran's Leader Mahmoud Ahmadinejad declared Jihad to USA
The World War III has already begun
The begining of The World War III
The military operation in Iran has begun
The secret war against Iran
Third War in Iran
Third World War has begun
US Army crossed Iran's borders
US Army invaded Iran
US army is about 20 kilometers from Tegeran
US soldiers occupied Iran
USA attacked Iran
USA declares war on Iran
USA occupeid Iran
USA unleashed war on Iran
War between USA&Iran
War with Iran is the reality now
Washington prefers to shoot first

The following is a selection of the body text:

20000 US soldiers in Iran http://xxxxxxxx.com/
Iran USA conflict developed into war http://xxxxxxxx.com/
More than 10000 Iranians were murdered http://xxxxxxxx.com/
Negotiations between USA and Iran ended in War http://xxxxxxxx.com/
Occupation of Iran http://xxxxxxxx.com/
Plans for Iran attack began http://xxxxxxxx.com/
The World War III has already begun http://xxxxxxxx.com/
The begining of The World War III http://xxxxxxxx.com/
The military operation in Iran has begun http://xxxxxxxx.com/
The secret war against Iran http://xxxxxxxx.com/
Third War in Iran http://xxxxxxxx.com/
Third World War has begun http://xxxxxxxx.com/
US Army crossed Iran's borders http://xxxxxxxx.com/
US Army invaded Iran http://xxxxxxxx.com/
US army is about 20 kilometers from Tegeran http://xxxxxxxx.com/
US soldiers occupied Iran http://xxxxxxxx.com/
USA attacked Iran http://xxxxxxxx.com/
USA declares war on Iran http://xxxxxxxx.com/
USA occupeid Iran http://xxxxxxxx.com/
USA unleashed war on Iran http://xxxxxxxx.com/
War between USA&Iran http://xxxxxxxx.com/
War with Iran is the reality now http://xxxxxxxx.com/
Washington prefers to shoot first http://xxxxxxxx.com/

Other than a change in theme, the Dorf authors have kept their campaign quite consistent these days. Visiting the website brings up the following page:

Iran occupation

The video player contains a picture of a nuclear explosion - suggesting that a nuclear exchange occurred as part of the supposed war. The "Ad banner" for "Veteran Accredited Program" is at the top of the site, which is not seen in all Dorf sites. Clicking on the banner will try to download the executable form.exe. The video player and the "click on the video" links will attempt to download iran_occupation.exe. Both executables are detected as Troj/Tibs-UO. Like the Independence day campaign, the Dorf site also contains a 1x1 iframe to ind.php, which we detect as Mal/ObfJS-AY.

As a note, it seems the Dorf authors have rushed this latest campaign and forgot to spell check their sentences, they spelled the Iranian capital Tehran as Tegeran, occupied as occupeid, and beginning as begining.

You might like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s