Don’t open that Western Union Transfer email

Our spam traps have been seeing a widespread malicious attack today, posing as a communication from Western Union.

The emails have a subject line of

Western Union Transfer MTCN: <random number>

and an attached file called MTCN_NR8621982.zip.

Malicious email claiming to come from Western Union

Part of the email reads as follows:

The money transfer you have sent on the 13th of March has not been collected by the recipient.
According to the Western Union agreement the transfers which are not received in 15 days are to be returned to sender. To collect cash you need to print the invoice attached to this e-mail and visit the nearest Western Union branch.

Of course, opening the attached file wouldn’t be the smartest move you’ve ever made in life, as it contains a malicious Trojan horse.

Interestingly, the malicious emails append some text to the bottom of each message to make it appear as though your mail gateway has scanned the message and determined it not to be spam. This takes a form similar to the following (where I use the name ‘example.com’ rather than the real recipient’s domain name):

[example.com : nospam]
[EMAILID: I8Y6CS_user@example.com]
[TIME:20090511125648]

Sophos detects the malware, known as Troj/Agent-JUC, and also protects customers of our email gateway products by intecepting the attack as spam.