Security firms increase efforts to halt the spread of the Storm worm after release of new span campaign

By Isabelle Chaize

The creators of the Storm malware, which has been running already for 14 months, have launched another new spam campaign.

Their aim is to connect even more users to their already wide-ranging botnet, which has been linked with spam runs and phishing attacks.

The new campaign takes the form of emails purporting to contain an online greeting card, and have subjects such as ‘Your ecard joke is waiting’, ‘You have an ecard’ and ‘We have a ecard surprise’. The message itself contains a link to a wep page where the user can see another link to the greeting card they are supposed to have received.

When they click on the link to the card, they unknowingly download an executable file which installs the Storm worm on their machine, which from then on is connected to a customised P-2-P network. The network is used to control the botnet and installs updated versions of the worm automatically onto the users computer.

Storm is thought to be one of the top current threats around on the Internet at the moment, and at the news of this further campaign, security firms are intensifying their endeavours to stop the worm.

ThreatStop has publicised its list of blocked Storm domains, normally reserved for its users only, in an attempt to beat the worm.

They said ‘we are taking this action because our users and test beds have seen that a significant amount of Storm worm traffic is blocked by the DShield lists that we propagate. When the internet as a whole is under assault like this we, as good netizens, should do our part to help.”

The general public will now be able to copy the blocklists and use them with firewall software to block traffic from sources known to distribute the Storm malware.