Spam and phishing

The return of mp3 spam

We’ve just detected a wave of mp3 spam. There aren’t any links in the message: all the information is in the audio file attached to the message.

Play the file, and you get 4 seconds of a female voice giving a web address for Viagra and similar medications. In the background there are passionate sighs and groans (presumably to persuade you that by purchasing Viagra, you’ll reach unparalleled heights of bliss!)

Just in case you can’t make out what the woman’s saying, the key words ‘CHEAP VIAGRA’ and the site address are included in the name of the track.

Spam in mp3 format first appeared in autumn 2007, pushing pump and dump shares. Audio spam never took off because of a whole range of limitations such as the large file size, and the poor quality of the recordings. Today’s mailing, though, shows that spammers are having another go at using this technique to push their goods and services.

The return of mp3 spam

Your email address will not be published. Required fields are marked *

 

Reports

Focus on DroxiDat/SystemBC

An unknown actor targeted an electric utility in southern Africa with Cobalt Strike beacons and DroxiDat, a new variant of the SystemBC payload. We speculate that this incident was in the initial stages of a ransomware attack.

APT trends report Q2 2023

This is our latest summary of the significant events and findings, focusing on activities that we observed during Q2 2023.

Meet the GoldenJackal APT group. Don’t expect any howls

GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. The main feature of this group is a specific toolset of .NET malware, JackalControl, JackalWorm, JackalSteal, JackalPerInfo and JackalScreenWatcher.

Subscribe to our weekly e-mails

The hottest research right in your inbox