Forest Global Training Partners

Cyber Risks · Krebs on Security

Spam & Fake AV: Like Ham & Eggs

Summary: UCSB researcher Brett Stone-Gross and Krebs compared ICQ numbers and found that 417 of 998 affiliates (42.2 percent) registered with the largest fake AV distribution service were also registered pharma spammers with Glavmed/Spamit, with email-address overlap between 19 and 27 percent across all three fake AV programs studied. A key Spamit member, Peter Severa, ran a fake AV affiliate program called Sevantivir whose installer downloaded both a fake AV program called Security Shield and a spambot detected by Microsoft as Win32.Kelihos.b, which Microsoft says shares large portions of its code with the Waledac worm.

Why it matters: A single installer was doing double duty - pushing worthless antivirus and seeding a spambot - so one infection paid the same operator twice, and the 42.2 percent affiliate overlap shows the fake AV and pharma spam operations were staffed by the same people rather than separate crews.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related