Sophos Cloud Optix
Don’t worry readers, a new war hasn’t started. What you see instead is the latest is the latest campaign from the Dorf (Storm) botnet. Just 4 days after after the Independence day fireworks campaign, the Dorf authors are back with a renewed campaign. This time they are taking advantage of the tension in the Middle East.
Here are some of the latest email subjects:
20000 US soldiers in Iran
Iran USA conflict developed into war
More than 10000 Iranians were murdered
Negotiations between USA and Iran ended in War
Occupation of Iran
Plans for Iran attack began
The Iran’s Leader Mahmoud Ahmadinejad declared Jihad to USA
The World War III has already begun
The begining of The World War III
The military operation in Iran has begun
The secret war against Iran
Third War in Iran
Third World War has begun
US Army crossed Iran’s borders
US Army invaded Iran
US army is about 20 kilometers from Tegeran
US soldiers occupied Iran
USA attacked Iran
USA declares war on Iran
USA occupeid Iran
USA unleashed war on Iran
War between USA&Iran
War with Iran is the reality now
Washington prefers to shoot first
The following is a selection of the body text:
20000 US soldiers in Iran http://xxxxxxxx.com/
Iran USA conflict developed into war http://xxxxxxxx.com/
More than 10000 Iranians were murdered http://xxxxxxxx.com/
Negotiations between USA and Iran ended in War http://xxxxxxxx.com/
Occupation of Iran http://xxxxxxxx.com/
Plans for Iran attack began http://xxxxxxxx.com/
The World War III has already begun http://xxxxxxxx.com/
The begining of The World War III http://xxxxxxxx.com/
The military operation in Iran has begun http://xxxxxxxx.com/
The secret war against Iran http://xxxxxxxx.com/
Third War in Iran http://xxxxxxxx.com/
Third World War has begun http://xxxxxxxx.com/
US Army crossed Iran’s borders http://xxxxxxxx.com/
US Army invaded Iran http://xxxxxxxx.com/
US army is about 20 kilometers from Tegeran http://xxxxxxxx.com/
US soldiers occupied Iran http://xxxxxxxx.com/
USA attacked Iran http://xxxxxxxx.com/
USA declares war on Iran http://xxxxxxxx.com/
USA occupeid Iran http://xxxxxxxx.com/
USA unleashed war on Iran http://xxxxxxxx.com/
War between USA&Iran http://xxxxxxxx.com/
War with Iran is the reality now http://xxxxxxxx.com/
Washington prefers to shoot first http://xxxxxxxx.com/
Other than a change in theme, the Dorf authors have kept their campaign quite consistent these days. Visiting the website brings up the following page:
The video player contains a picture of a nuclear explosion – suggesting that a nuclear exchange occurred as part of the supposed war. The “Ad banner” for “Veteran Accredited Program” is at the top of the site, which is not seen in all Dorf sites. Clicking on the banner will try to download the executable form.exe. The video player and the “click on the video” links will attempt to download iran_occupation.exe. Both executables are detected as Troj/Tibs-UO. Like the Independence day campaign, the Dorf site also contains a 1×1 iframe to ind.php, which we detect as Mal/ObfJS-AY.
As a note, it seems the Dorf authors have rushed this latest campaign and forgot to spell check their sentences, they spelled the Iranian capital Tehran as Tegeran, occupied as occupeid, and beginning as begining.