Cybercriminals seek appointment on Valentine's Day

Cybercriminals seek appointment on Valentine's Day

The Necurs bot increases its activity on February 14, as on other dates in which cybercriminals know that there is more internet traffic

     Love also knocks on the door of the bots and in this case it reaches the email boxes. Cybercriminals have the most trafficked dates on the Internet, Christmas, Black Friday and Cyber ​​Monday in red; and, also, Valentine's Day.

IBM X-Force has observed a general increase in unwanted emails related to online dating, from the Necurs botnet. This rebound began in mid-January and continues as Valentine's Day approaches. "Necurs is one of the biggest botnets in the world. It emerged in 2012 as an infector and rootkit, and quickly became associated with elite cybercrime gangs to become part of the main forces of spam and infection in the malware field, "says Eduardo Argüeso, director of the IBM Security unit at Spain


     The current campaign of Necurs has reached more than 230 million spam in a matter of two weeks, after the botnet launched tens of millions of messages in two major attacks. The first included the period between January 16 and January 18, and the second episode occurred between January 27 and February 3. "Unlike most bot networks, Necurs stands out for its technical complexity, diversity of associations and evolution continues in an era in which even the most complex malicious infrastructures no longer withstand interruptions," adds Argüeso

With a pace of 30 million emails a day, the current Necurs campaign launches its possible victims some very short texts supposedly written by Russian women living in the United States. "If the spams are known to have enough errors in spelling and grammar, these messages stood out instead for their good writing," says IBM on its website.

Contact by mail
In the email appeared an email with the name of the alleged sender, who then asked the recipient to contact her using another address that referred to a completely different person. "The best way to prevent these emails is through the training and awareness of users in relation to these types of malicious emails that should never be opened or answered," says the director of the IBM Security unit in Spain.

IBM remembers that the main objective of these campaigns is to attract their victims so that they share compromised photos so they can extort money from them, ask for money to visit them or infect their computers with malware. "The main thing is to make users aware of the threats posed by this type of malicious emails, which should never be opened or answered. And of course, never click on the links that come in those emails or follow the instructions that may include, "recalls Argüeso.

In addition, Necurs is notable for its links to malware that spreads banking Trojans, such as Dridex and Trickbot, as well as the Locky, Scarab and Jaff ransonware. But not only live Necurs operators, but they also distribute spams for other fraud attempts.

Mass shipment
Spam was sent from approximately 950,000 different IP addresses. The main sender in the list of IP addresses was one hosted through an ISP based in Pakistan. That IP address (103.255.5.117) had been reported by spams some 655 times, at the time this article was written, and is currently ranked at risk by 10 out of 10, according to the IBM X-Force Exchange.

The senders came in most cases from Vietnam and India, with 55% of the IP addresses during the campaign.