Snowshoe Spam Attack Comes and Goes in a Flurry
Summary: Cisco Talos observed a spam campaign on August 15 that combined snowshoe techniques with PDF exploitation, sending identical PDF attachments flagged as a Trojan exploiting CVE-2013-2729, an integer overflow vulnerability in Adobe Reader 9.x, 10.x and 11.x. The campaign lasted about 3 hours but accounted for almost 10% of spam volume at one point, and Talos reported snowshoe spam volume has doubled since November 2013.
Bottom line: Snowshoe spam spreads low volume across many IP addresses with little reuse, which is designed to evade IP reputation metrics, and many of the IPs in this campaign had no prior record of sending mail, suggesting compromised machines were turned into fresh infrastructure.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2013-2729
- Related
- CVE-2013-2729: Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022Tracking New Ransomware Crypto Wall 2.0 Cyber Risks ·ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026